Sharepoint Cross Domain Issue (Edge Browser)

Question

I am trying to do post action from cross domain site and i am getting below

error: HTTP403: FORBIDDEN - The server understood the request, but is refusing to fulfill it.

Code:

var formDigest;
$.ajax({
    url: "http://abc.com/sites/abc/_api/contextinfo",
    type: 'POST',
    async: false,
    xhrFields: { withCredentials: true },
    headers: {
        "accept": "application/json;odata=verbose"
    },
    success: function (data) {debugger;
        if (data.d) {
            formDigest = data.d.GetContextWebInformation.FormDigestValue;  
        }
    },
    error: function (err) {debugger;
        alert(err);
    }
});

item=JSON.stringify({  
        __metadata:  
        {  
            type: "SP.Data.TestForCrossDomainIssuesListItem"  
        },  
        'Title': 'Testing from cross web app Site using Edge browser'
    });
$.ajax({  
    url: "http://abc.com/sites/abc/_api/lists/getbytitle('TestForCrossDomainIssues')/Items",  
    type: "POST",  
    data:item,
    xhrFields: { withCredentials: true },   
    crossDomain: true,
    contentType:'application/json',
    headers:  
    {  
        "Accept": "application/json;odata=verbose",  
        "Content-Type": "application/json;odata=verbose",  
        "X-RequestDigest": formDigest,  
        "X-HTTP-Method": "POST"  
    },  
    success: function(data, status, xhr)  
    {  
        console.log('in Success');
    },  
    error: function(xhr, status, error)  
    {   
        console.log('in Error' +status);  
    }  
});

I have added rewrite url as mentioned in below ref

ref:How to add multiple URL to Access-Control-Allow-Origin header in SharePoint 2013 web.config

Answer 1

Since a while, I don’t remember from which SharePoint CU, Microsoft implemented CORS and enhanced the related security. But it has been done by hard coding some routines in internal SharePoint codes.

So, the trick to add headers trough IIS web config or rewrite rules are not working anymore.

I faced that issue few years ago, the solution is writing down your own HTTP Module to catch CORS Preflight requests (HTTP OPTIONS) and ensure the others http methods are allowed according to the ORIGIN and referer.

Sample made long time ago, but still relevant.