I am currently looking at the SSO Implementation and I am stuck at a point, where I get the following error:
Response to preflight request doesn’t pass access control check: No ‘Access-Control-Allow-Origin’ header is present on the requested resource. Origin
After reading and googling, I turned CURL off in my browser, which lead to the following error:
Response for preflight has invalid HTTP status code 404
I read through all the posts and stuff, but I do not realize, what is wrong here. Here is my JS:
state = getURLParameter('state');
code = getURLParameter('code');
clid = "clientid"; //off course these are set to my apps values
secr = "secret";
url = "https://login.eveonline.com/oauth/token";
var method = "POST";
var pcode = btoa(clid+":"+secr);
var heada = "Basic " + pcode;
var postData =
{
“grant_type”:“authorization_code”,
“code”:code
}
var async = true;
var request = new XMLHttpRequest();
Request.onload = function () {
var status = request.status;
var data = request.responseText;
}
request.open(method, url, async);
request.setRequestHeader("Authorization", heada);
request.setRequestHeader("Content-Type", "application/json");
request.setRequestHeader("Cache-Control","no-cache");
request.send(postData);
once I try to get a charcter ID I get the same problem again also with the explicit method. I even completely copied your method, so it gets the same parameters, nothing.
Well it definitely seems to be a CORS issue. I wonder how I can get around it, cause in the CORS definition it says the server needs to have a setting like
I doubt, CCP will do this for everyone, so the concept behind this should be something else, which I am still missing, which for sure is my fault. I will completely redo the code and post again if it fails.
Inbetween, if there is someone who REALLY knows, I’ll pay 250M ISK for a working, commented and readable solution, just login using EVE SSO, get a token, get a character ID and retrieve something from the character.
This might be a bug? ESI endpoints should have Access-Control-Allow-Origin: *. Or at least pretty much all the ones i saw. However, im not sure if the SSO login URL should be included in that.
However this is an SSO issue so you’d have to talk to the mystical SSO team.
Ok, after reading everything, I do not think this works correctly. So if there is anyone who actally managed to get a character ID within a browser session (not only a token token is easy using implicit) please let me know.
And it would be nice if CCP would get someone in just to make it clear. Is the Allow-Access-Origins header set or not?
I am still offering 250M ISK for a working solution using a webpage and js.
it finally works, but I think for no reason. I did a GET request using $,ajax, while you are doing a $.jsonGET, which in my opinion in this case are the same. Doing getJSON worked for me, so I will not bother finding out the difference
I sent you 250 M ISK (Proof: https://i.imgur.com/HxDdBRJ.png) , as you provided a working solution and I am keeping my promise. Thanks again and you have my next CSM vote again!
