/
Enabling CORS

Enabling CORS

To allow iShare content to be loaded into a page hosted on a different domain, e.g. to load it into a Spotlight map, you’ll need to allow for CORS. See What is CORS? for more information.

Firstly, on the iShare Maps server if not already installed, install the IIS CORS module from here: https://www.iis.net/downloads/microsoft/iis-cors-module.

The IIS CORS module is configured via the <cors> element as part of the <system.webServer> section. The section can be configured at the server, site, or application level for instance by updating the D:\Astun\iShare\LIVE\WebApps\Web\web.config file. Notes on how to configure the module here: https://blogs.iis.net/iisteam/getting-started-with-the-iis-cors-module.

Configuration

Remove duplicate customHeaders

<httpProtocol> <customHeaders> <remove name="Access-Control-Allow-Origin" /> </customHeaders> </httpProtocol>

Allow specific sites

This is the most likely scenario, and will allow you to add ol-ishare.services.astuntechnology.com and the domain(s) used by the customer site(s) like so.

<system.webServer> ... <cors enabled="true"> <add origin="https://ol-ishare.services.astuntechnology.com"> <allowMethods> <add method="GET" /> <add method="HEAD" /> </allowMethods> </add> <add origin="https://*.example.gov.uk"> <allowMethods> <add method="GET" /> <add method="HEAD" /> </allowMethods> </add> </cors> ... </system.webServer>

Allow all sites

In this simplest example, the CORS module module will allow requests from all origins. Note that this will probably be flagged as a vulnerability by security audits.

<system.webServer> ..... <cors enabled="true"> <add origin="*" /> </cors> ..... </system.webServer>

Testing

To test whether CORS has been enabled :

  • Visit https://ol-ishare.services.astuntechnology.com/v1/apps/spotlight/

  • Open Developer Tools in your browser, then select the Network panel

  • Enter the iShare Maps URL for the site in question into the iShare URL field in Spotlight.

    • For example: https://maps.example.gov.uk/

  • If the map doesn't load, then CORS probably isn't enabled. If that is the case you will see a failed/ blocked request in the Network panel for getdata.aspx