SEC7118: XMLHttpRequest CORS - IE Console message

Question

I am using CORS POST request with everything taken care as given @http://www.html5rocks.com/en/tutorials/cors/

Server sets Response header to: 'Access-Control-Allow-Origin':'*' and I can see this header value in IE developer tool.

But on IE10 browser I see console message as "SEC7118: XMLHttpRequest for http:// required Cross Origin Resource Sharing (CORS).

When I check on Microsoft site it has below given explanation.

http://msdn.microsoft.com/en-us/ie/dn423949(v=vs.94).aspx

SEC7118

Description: "XMLHttpRequest for [URL] required Cross Origin Resource Sharing (CORS). " An XMLHttpRequest was made to a domain that was different than your page's domain. This requires the server to return an "Access-Control-Allow-Origin" header in its response headers, but one was not returned.

Suggested Fix: The server must support CORS requests and return an appropriate "Access-Control-Allow-Origin" header with the resource. See CORS for XHR in IE10 for more info about CORS in response headers.

Questions:

1. I want to know if this console message is an ERROR ??
2. Will this cause any failures ??
3. Why do I get this message even after setting response header 'Access-Control-Allow-Origin' value to '*'??
4. Does 'Access-Control-Allow-Origin' value has to be origin name for IE10 to work? I know * is not a very good option, But does IE requires exact origin name ??

I kept URL's and cookie details hidden from these images.

Answer 1

From MSDN:

Security error codes are in the form SEC7xxx [In IE]

Pertaining to SEC7118:

An XMLHttpRequest was made to a domain that was different than your page's domain. This requires the server to return an "Access-Control-Allow-Origin" header in its response headers, but one was not returned.

Note This error code was removed in IE11 on Windows 10. It remains in IE11 for Windows 8.1 and Windows 7.

So it is technically viewed as an error from IE's perspective, but certainly isn't one (hence why it is going away). Access-Control-Allow-Origin is set on a resource, but isn't necessarily sent back with the request. If a specified resource DOESN'T have Access-Control-Allow-Origin:* (or a domain), the resource would not be accessible and the server would likely return a 503 or 404 and you would see a true error message in the console similar to the below:

XMLHttpRequest cannot load http://example.com/. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://blog.example.com' is therefore not allowed access.

Answer 2

I encountered SEC7118 when CORS was set up correctly. I verified that the requests were completing with status 200 using the network debugger. So, you can disregard this message if your application is otherwise functioning properly.

Answer 3

I have seen this error in IE11:

SEC7118: XMLHttpRequest for http:// required Cross Origin Resource Sharing (CORS)

Adding the following to my .htaccess fixed it:

<IfModule mod_setenvif.c>
    <IfModule mod_headers.c>
        <FilesMatch "\.(cur|gif|ico|jpe?g|png|svgz?|webp)$">
            SetEnvIf Origin ":" IS_CORS
            Header set Access-Control-Allow-Origin "*" env=IS_CORS
        </FilesMatch>
    </IfModule>
</IfModule>

Reference: https://developer.mozilla.org/en-US/docs/Web/HTML/CORS_enabled_image

Answer 4

I had this same issue. It has to do with Internet Explorer's handing of third party cookies. You can fix this issue by going into Tools>Internet Options then selecting the Privacy tab. If you change the setting to "Accept All Cookies" you will no longer see that message.

The safer way to do this would be to click on the "Sites" button and allow cookies from your site's url.