Error: unable to make request (may be blocked due to cross-domain permission) when target build is html5

Help
#1

Hi everyone, i create project openfl, with target build is html5. When i used urlRequest and urlLoader to call service, i see dispath IOErrorEvent with error text: unable to make request (may be blocked due to cross-domain permission). I created crossdomain.xml but not success
Help me fix this bug, thanks!

this is my code:

package request;

import haxe.Constraints.Function;
import haxe.Http;
import haxe.Json;
import js.Browser;
import js.Lib;
import openfl.events.Event;
import openfl.events.EventDispatcher;
import openfl.events.IEventDispatcher;
import openfl.events.IOErrorEvent;
import openfl.events.TimerEvent;
import openfl.net.URLLoader;

import openfl.net.URLLoaderDataFormat;
import openfl.net.URLRequest;
import openfl.net.URLRequestHeader;
import openfl.net.URLRequestMethod;
import openfl.net.URLVariables;
import openfl.system.ApplicationDomain;
import openfl.system.Security;
import openfl.system.System;
import openfl.utils.Object;
import openfl.utils.Timer;

/**
* ...
* @author bimkute
*/
class HTTPRequest extends EventDispatcher
{
public static var LOAD_COMPLETE:String = "loadComplete";
private var urlRequest:URLRequest;
private var urlLoader:URLLoader;
private var urlHttp:Http;
private var completeFunction:Function;
private var timeOutTimer:Timer;
private var value:Object;
private var isDecode:Bool;

public function new(target:IEventDispatcher=null) 
{
	super(target);

}

public function sendRequest(method:String, url:String, _value:Object, _completeFunction:Function, _isDecode:Bool = false, timeOut:Int = 10, dataFormat:String = "text"):Void
{
	isDecode = _isDecode;

	completeFunction = _completeFunction;
	value = _value;

	Security.allowDomain("*");
	Security.allowInsecureDomain("*");
	Security.loadPolicyFile('http://sanhbai.com/crossdomain.xml');
	Security.loadPolicyFile('http://test.sanhbai.com/crossdomain.xml');

	var _postData:Dynamic;
	var _uv:URLVariables = new URLVariables();
	for(_name in _value)
	{
		Reflect.setProperty(_uv, _name, _value[_name]);

	}
	_postData = _uv;

	urlRequest = new URLRequest(url);
	urlRequest.method = method;
	urlRequest.contentType = "application/json";
	urlRequest.requestHeaders.push( new URLRequestHeader( 'Cache-Control', 'no-cache' ) );
	urlRequest.requestHeaders.push( new URLRequestHeader( "Content-type", "application/x-www-form-urlencoded") );
	urlRequest.requestHeaders.push( new URLRequestHeader( "X-HTTP-Method-Override", "DELETE") );


	if (method == URLRequestMethod.POST)
	{

		urlRequest.data = _uv;
	}


	urlLoader = new URLLoader();
	urlLoader.dataFormat = URLLoaderDataFormat.TEXT;
	urlLoader.addEventListener(Event.COMPLETE, onRequestComplete);
	urlLoader.addEventListener(IOErrorEvent.IO_ERROR , onIOError);

	urlLoader.load(urlRequest);

}

private function onTimeOut(e:TimerEvent):Void 
{
	clearAll();
}

private function onIOError(e:IOErrorEvent):Void 
{
	Browser.alert("IO_ERROR - Link này bị sai rùi" + e.currentTarget + '--' + e.errorID + '--' + e.type + '--' + e.text);
	completeFunction( { "status":"IO_ERROR", "description":"link bị sai rùi" } );

	clearAll();
}

private function onRequestComplete(e:Event):Void 
{
	Browser.alert('call login success: ' + e.currentTarget.data);
	if (isDecode)
	{
		if (e.currentTarget.data != "")
		{

			completeFunction(Json.parse(e.currentTarget.data));
		}
	}
	else
	{
		completeFunction(e.currentTarget.data);
	}

	clearAll();
	urlRequest = null;
	urlLoader = null;
	completeFunction = null;
	timeOutTimer = null;
	value = null;
	dispatchEvent(new Event(LOAD_COMPLETE));
}

private function clearAll():Void
{
	if (timeOutTimer != null)
	{
		timeOutTimer.removeEventListener(TimerEvent.TIMER_COMPLETE, onTimeOut);
		timeOutTimer.stop();
		timeOutTimer = null;
	}

	urlLoader.removeEventListener(Event.COMPLETE, onRequestComplete);
	urlLoader.removeEventListener(IOErrorEvent.IO_ERROR , onIOError);
	dispatchEvent(new Event(LOAD_COMPLETE));
}
#2

Hi!

I believe you need to add response headers on the server side, otherwise you’ll get problems with cross-domain resources:

This is a browser security feature we can’t work around, though we try to do what we can

#3

Hi
I had the same issue with OpenFL when target HTML5. to solve the issue have added the following headers to my server response
the server code is developed with haxe php target

Web.setHeader(“Access-Control-Allow-Origin”, “*”);
Web.setHeader(“Access-Control-Allow-Methods”, “GET, PUT, POST, DELETE, OPTIONS”);
Web.setHeader(“Access-Control-Allow-Headers”, “Content-Type, Content-Range, Content-Disposition, Content-Description”);

you should add them before doing any Lib.print call

1 Like