{"id":1583,"date":"2009-11-05T22:43:08","date_gmt":"2009-11-05T22:43:08","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/odatateam\/2009\/11\/05\/enabling-x-domain-access-to-your-data-services\/"},"modified":"2009-11-05T22:43:08","modified_gmt":"2009-11-05T22:43:08","slug":"enabling-x-domain-access-to-your-data-services","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/odata\/enabling-x-domain-access-to-your-data-services\/","title":{"rendered":"Enabling X-Domain access to your Data Services"},"content":{"rendered":"

In the Astoria V1.5 CTP2 release, we introduced support for X-Domain and Out Of Browser access to Data Services<\/a> in our Silverlight client library. <\/p>\n

This blog post talks about how to enable Cross-Domain access to Data Services from the Silverlight client library. <\/p>\n

I am a Service author, How do I enable X-Domain access to Data Services I host in my applications?<\/h3>\n

You would need to deploy a ClientAccessPolicy.xml file to enable X-Domain and Out Of Browser access to Data Services hosted by your applications. <\/p>\n

The CAP.xml file should be deployed at the root of the Web Server hosting the Data Services and should not require authentication to access the file.<\/p>\n

What is a <\/b>ClientAccessPolicy.xml<\/a><\/b> file? <\/b><\/h3>\n

A client access policy file defines the Services that client Silverlight applications can call
and the capabilities that these service calls can have.
Here is a sample client access policy.xml file : <\/p>\n

<?xml version="1.0" encoding="utf-8"?>
<\/font><access-policy>
<\/font>  <cross-domain-access>
<\/font>    <policy>
<\/font>      <allow-from http-request-headers="*">
<\/font>        <domain uri="http:\/\/ui.norhtwind.com"\/>
<\/font>      <\/allow-from>
<\/font>      <grant-to>
<\/font>        <resource path="\/Northwind.svc" include-subpaths="true"\/>
<\/font>      <\/grant-to>
<\/font>    <\/policy>
<\/font>  <\/cross-domain-access>
<\/font><\/access-policy><\/font><\/p>\n

Anatomy of  a ClientAccessPolicy.xml file:<\/h3>\n

The CAP.xml file contains a lot of sections to allow fine tuning of client access.
For a Data Service author, the following are relevant sections of the file: <\/p>\n

1. <allow-from> <\/b><\/p>\n

Defines all the domains that are affected by this policy. <\/p>\n

Defines the sites that are allowed to access resources in a certain policy. <\/p>\n

By using the allow-from element for a particular policy, you implicitly deny access for all non-listed domains. <\/p>\n

If allow-from is empty, then the policy file grants access to no sites. <\/p>\n

The \u201chttp-request-headers<\/b>\u201d  attribute of this node specifies the HTTP Request headers that client Service calls are allowed to pass to the Service. <\/p>\n

For a Data Services Silverlight client application, the following headers are required <\/p>\n

    \n
      \n
    1. X-Http-Method <\/li>\n
    2. DataServiceVersion  <\/li>\n
    3. Accept <\/li>\n
    4. Content-Type <\/li>\n
    5. Location <\/li>\n
    6. MimeType  <\/li>\n
    7. MaxDataServiceVersion <\/li>\n<\/ol>\n<\/ol>\n

      2. <allow-from><domain\/><\/allow-from><\/b><\/p>\n

      The \u201curi\u201d<\/b> attribute of the \u201cdomain<\/b>\u201d node specifies the domain in which the client accessing the Service has to be hosted
      to be able to call the Service.<\/p>\n

      3. <grant-to> <\/b><\/p>\n

      The \u201c<grant-to>\u201d node specifies the Services which are allowed to be accessed by clients. <\/p>\n

      4. <grant-to><resource\/><\/grant-to> <\/b><\/p>\n

      Each service , access to which is governed by the CAP.xml file, is represented by a <resource> <\/b>node in the <grant-to><\/b> section of the CAP.xml file . <\/p>\n

      The <resource> <\/b>node contains two important attributes. <\/p>\n

        \n
          \n
        1. path <\/b>: this attribute is the relative path of the Data Service <\/li>\n
        2. include-subpaths<\/strong>  : this attribute specifies if paths based off of the resource path are allowed. This value should be set to true for a Data Service. <\/li>\n<\/ol>\n<\/ol>\n

          Additional references:<\/h3>\n
            \n
          1. Clientaccesspolicy.xml file Schema<\/a><\/li>\n
          2. Making a Service Available Across Domain Boundaries<\/a><\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"

            In the Astoria V1.5 CTP2 release, we introduced support for X-Domain and Out Of Browser access to Data Services in our Silverlight client library. This blog post talks about how to enable Cross-Domain access to Data Services from the Silverlight client library. I am a Service author, How do I enable X-Domain access to Data […]<\/p>\n","protected":false},"author":512,"featured_media":3253,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[6,37,67,92],"class_list":["post-1583","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-odata","tag-ado-net-data-services","tag-how-to","tag-silverlight","tag-x-domain"],"acf":[],"blog_post_summary":"

            In the Astoria V1.5 CTP2 release, we introduced support for X-Domain and Out Of Browser access to Data Services in our Silverlight client library. This blog post talks about how to enable Cross-Domain access to Data Services from the Silverlight client library. I am a Service author, How do I enable X-Domain access to Data […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/odata\/wp-json\/wp\/v2\/posts\/1583","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/odata\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/odata\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/odata\/wp-json\/wp\/v2\/users\/512"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/odata\/wp-json\/wp\/v2\/comments?post=1583"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/odata\/wp-json\/wp\/v2\/posts\/1583\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/odata\/wp-json\/wp\/v2\/media\/3253"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/odata\/wp-json\/wp\/v2\/media?parent=1583"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/odata\/wp-json\/wp\/v2\/categories?post=1583"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/odata\/wp-json\/wp\/v2\/tags?post=1583"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}