Problems with Javascript and CORS

[Joanne Halliwell]

I've got an existing REST API running on Taffy which has been working fine, however I've now got a client who wants to integrate using Javascript. I've enabled the allowCrossDomain setting in the framework but I'm still getting preflight error messages in my test harness.

It's a very simple piece of code that is calling the API

function test(){

    alert("in function");

    var jsonBody = {};

    jsonBody.matterReference = 'testRef1';

    console.log(jsonBody);

    console.log(JSON.stringify(jsonBody));

    var xhr = new XMLHttpRequest();  

    xhr.open("POST","https://api.etsos.co.uk/orders/createQuickCase");

    xhr.setRequestHeader("Authorization","Basic " + btoa("gazealdemo" + ":" + "letmein001"));

    xhr.setRequestHeader('Content-Type', 'application/json');

    xhr.send(JSON.stringify(jsonBody)); 

    console.log(xhr.response);

    console.log(xhr.responseText);

    

     alert("end function");

}

However the output in Chrome is throwing the following:

OPTIONS https://api.etsos.co.uk/orders/createQuickCase 403 (Forbidden)
XMLHttpRequest cannot load https://api.etsos.co.uk/orders/createQuickCase. Response for preflight has invalid HTTP status code 403

I can get it working by putting the following in the onTaffyRequest()

if (findNoCase(verb,"options")){
            return newRepresentation()
                    .setData({OK="OK"})
                    .withStatus(200);
        }

but it doesn't return the correct data, which should be a reference from our system.

Can anyone help with this?