I am trying to retrieve JSON responses from an API. I keep getting "Cross-Origin Read Blocking (CORB) blocked cross-origin response", causing an error. I have searched the web trying to find what could be the issue but I am failing.
The API has to return a generated session.
When I inspect the header I see that there are multiple headers attached to the request.
The funny thing is that when i copy the URL directly on to my web browser, i get the json response with the values but once i use the url in an ajax function, i get denied.
jQuery.ajax({
type: 'GET',
crossOrigin: true,
url: "https://apitest.mobzgo.co.za/getSession?username=********&passingword=*****",
dataType: "jsonp",
contentType: "jsonp;",
success: function (response) {
alert(JSON.stringify(response));
},
error: function (jqXHR, exception, errorThrown) {
var msg = '';
if (jqXHR.status === 0) {
msg = 'Not connect.\n Verify Network.';
} else if (jqXHR.status === 404) {
msg = 'Requested page not found. [404]';
} else if (jqXHR.status === 500) {
msg = 'Internal Server Error [500].';
} else if (exception === 'parsererror') {
msg = errorThrown;
} else if (exception === 'timeout') {
msg = 'Time out error.';
} else if (exception === 'abort') {
msg = 'Ajax request aborted.';
} else {
msg = 'Uncaught Error.\n' + jqXHR.responseText;
}
alert(msg);
}
});
CORB errors occur when you try to treat some data from a different origin as if it was a different kind of data.
e.g. <img src="http://example.com/foo.html"> - an HTML document is not an image.
In this case you said dataType: "jsonp", so you are trying to treat the URL as JavaScript (since JSONP is specially formatted JavaScript). It isn't JavaScript so, rather then trying to execute it and throwing an exception from that, it just throws an exception when it detects it isn't JS.
Aside: contentType: "jsonp;", — JSONP isn't a content-type and you are making a GET request so there is no request body to describe the type of anyway. What's more, JSONP requests can't set the content-type. This is wrong and pointless in multiple ways.
Note also that JSONP is nasty. It is limited and has security concerns. When building an API today there is no good reason to support cross-origin requests using JSONP. We have CORS now. CORS is much safer and more powerful.