Soporte de The Movie Database

Hello all, trying to get some practice with this API and am currently working on caching the image url data as suggested on this page.

I'm trying to make a Cordova Android app, so I'm using Javascript to request the information. However, in my development environment (which is localhost for the domain) I'm getting the error:

Failed to load https://api.themoviedb.org/3/configuration?api_key=MYAPIKEY The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. Origin 'http://localhost' is therefore not allowed access. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.

I'm using the code that is suggested on that page under the Javascript - XMLHttpRequest section which is:

var data = "{}";

var xhr = new XMLHttpRequest();
    xhr.withCredentials = true;

    xhr.addEventListener("readystatechange", function () {
      if (this.readyState === this.DONE) {
        console.log(this.responseText);
      }
    });

    xhr.open("GET", "https://api.themoviedb.org/3/configuration?api_key=MYAPIKEY");

    xhr.send(data);

Due to the nature of the error and it specifically mentioning the "withCredentials", I simply removed the third line in the above code (xhr.withCredentials=true;) and ran the program again, it was successful.

I then restored the withCredentials line and tried to change my htaccess file:

Before

<IfModule mod_headers.c>
    Header set Access-Control-Allow-Origin "*"
</IfModule>

Attempt 1

<IfModule mod_headers.c>
    Header set Access-Control-Allow-Origin "https://api.themoviedb.org/3/configuration?api_key=MYAPIKEY"
</IfModule>

Attempt 2

<IfModule mod_headers.c>
    Header set Access-Control-Allow-Origin "http://localhost"
</IfModule>

Both of the attempts resulted in the same error as above. In addition to these attempts I tried to use CORS rather than the standard XML request and it had the same error.

After looking through this forum for related issues, I saw that I should be using JSONP rather than the default configuration, however, I'm a little confused as to why the withCredentials is in the example code yet it doesn't seem to be required, so I have a few questions...

Related threads I read through: Thread 1 Thread 2

Questions

  1. Is there any problem with taking out that withCredentials line and simply moving forward with API calls? (any security concerns maybe?)

  2. Will using withCredentials on a different domain than localhost work? (is localhost simply limited?)

  3. Any specific suggestions for this particular situation going forward?

Thanks in advance, I know that this is long winded, but I didn't want to leave out any details since I've been Googling for a while and seen a lot of the same "fixes" around.

Edit: Layout for easier reading

3 respuestas (en la página 1 de 1)

Jump to last post

Hi @matt.lawrence,

I am no help with anything related to Cordova or Android, but often is the case when it comes to CORS issues, it's because you need to use JSONP.

Have you tried that?

I was able to get the API configuration successfully pulled using JSONP so I think that I should be good going forward. Thank you for the assistance.

Out of technical curiosity, in what circumstance would Javascript be used, using the withCredentials set to true? Wouldn't all requests (other than internal ones from your own website, I assume) come from other domains and come up with the cross domain issue?

Hey Matt,

I was able to get the API configuration successfully pulled using JSONP so I think that I should be good going forward. Thank you for the assistance.

Perfect thumbsup_tone2

Out of technical curiosity, in what circumstance would Javascript be used, using the withCredentials set to true?

I'm not sure what withCredentials is for or does so I don't think I can be much help with that question.

¿No encuentras una película o serie? Inicia sesión para crearla:

Global

s centrar la barra de búsqueda
p abrir menú de perfil
esc cierra una ventana abierta
? abrir la ventana de atajos del teclado

En las páginas multimedia

b retrocede (o a padre cuando sea aplicable)
e ir a la página de edición

En las páginas de temporada de televisión

(flecha derecha) ir a la temporada siguiente
(flecha izquierda) ir a la temporada anterior

En las páginas de episodio de televisión

(flecha derecha) ir al episodio siguiente
(flecha izquierda) ir al episodio anterior

En todas las páginas de imágenes

a abrir la ventana de añadir imagen

En todas las páginas de edición

t abrir la sección de traducción
ctrl+ s enviar formulario

En las páginas de discusión

n crear nueva discusión
w cambiar el estado de visualización
p cambiar público/privado
c cambiar cerrar/abrir
a abrir actividad
r responder a la discusión
l ir a la última respuesta
ctrl+ enter enviar tu mensaje
(flecha derecha) página siguiente
(flecha izquierda) página anterior

Configuraciones

¿Quieres puntuar o añadir este elemento a una lista?

Iniciar sesión