none
Few Bing Map Request Fails cause of Adding Custom header in XMLHttpRequest. RRS feed

  • Question

  • we are loading Bing map in our applications aspx page. and before sending any XMLHttpRequest we are adding custom header in to that request and due to that few Bing map request are failing with following error.

    Failed to load https://www.bing.com/fd/ls/lsp.aspx: Request header field "SOMECUSTOMHEADER" is not allowed by Access-Control-Allow-Headers in preflight response.

    we tried below code putting it into Head Tag of page.

    <meta http-equiv="Content-Security-Policy" content="default-src 'self' data: gap: https://ssl.gstatic.com 'unsafe-eval' 'unsafe-inline' https://*.bing.com https://*.virtualearth.net; style-src 'self' 'unsafe-inline' https://*.bing.com https://*.virtualearth.net; media-src *">

    so for now we added workaround for this is like we are not passing Custom Header with this "

    https://www.bing.com 
    
    https://t0.ssl.ak.dynamic.tiles.virtualearth.net 
    

     request and this resolved  our problem. 

    so is there any way or any setting to add Custom Header while sending the XMLHttpRequest?

    one more thing:

    the urls which are got used BingMap like below:

    https://www.bing.com 
    
    https://t0.ssl.ak.dynamic.tiles.virtualearth.net 

    how periodically these url's gets change because we have hardcoded these URL's to avoid extra addition of custom headers in this url's .

    Friday, March 2, 2018 10:44 AM

Answers

  • The security policy you mentioned is actually documented here: https://msdn.microsoft.com/en-US/library/mt793328.aspx

    The bing.com and virtualearth.net URL don't change often. virtualearth.net has been the main URL domain for Bing Maps for over 10 years. Bing Maps started using bing.com URLs for the web control about 3 or 4 years ago as part of the V8 web control release. It will be a long time before these change and if they do change it is likely to occur as part of a new version release.


    [Blog] [twitter] [LinkedIn]


    Friday, March 2, 2018 5:00 PM

All replies

  • The security policy you mentioned is actually documented here: https://msdn.microsoft.com/en-US/library/mt793328.aspx

    The bing.com and virtualearth.net URL don't change often. virtualearth.net has been the main URL domain for Bing Maps for over 10 years. Bing Maps started using bing.com URLs for the web control about 3 or 4 years ago as part of the V8 web control release. It will be a long time before these change and if they do change it is likely to occur as part of a new version release.


    [Blog] [twitter] [LinkedIn]


    Friday, March 2, 2018 5:00 PM
  • Thanks @Ricky_Brundritt

    Related to first issue

    Failed to load https://www.bing.com/fd/ls/lsp.aspx: Request header field "SOMECUSTOMHEADER" is not allowed by Access-Control-Allow-Headers in preflight response.

    do we have any configuration to avoid this error , because mentioned solution in below link (https://msdn.microsoft.com/en-US/library/mt793328.aspx) not solved my error in case of custom header?


    Monday, March 5, 2018 5:48 AM