Showing posts with label ASP.NET Web API. Show all posts
Showing posts with label ASP.NET Web API. Show all posts

Monday, April 27, 2015

Cross Origin Resource Sharing (CORS)

Cross Origin Resource Sharing (CORS) is a W3C standard that allows a server to relax the same-origin policy. Using CORS, a server can explicitly allow some cross-origin requests while rejecting others. CORS is safer and more flexible than earlier techniques such as JSONP.

he general mechanics of CORS are such that when JavaScript is attempting to make a cross-origin AJAX call the browser will “ask” the server if this is allowed by sending headers in the HTTP request (for example, Origin). The server indicates what’s allowed by returning HTTP headers in the response (for example, Access-Control-Allow-Origin). This permission check is done for each distinct URL the client invokes, which means different URLs can have different permissions.

In addition to the origin, CORS lets a server indicate which HTTP methods are allowed, which HTTP request headers a client can send, which HTTP response headers a client can read, and if the browser is allowed to automatically send or receive credentials (cookies or authorization headers). Additional request and response headers indicate which of these features are allowed.

Permission/Feature Request Header Response Header
Origin Origin Access-Control-Allow-Origin
Http Method Access-Control-Request-Method Access-Control-Allow-Method
Request Headers
Response Headers
Access-Control-Request-Headers Access-Control-Allow-Headers
Access-Control-Expose-Headers
Credentials   Access-Control-Allow-Credentials
Cache preflight Response   Access-Control-Max-Age

Technorati Tags: ,

Sunday, September 28, 2014

ASP.NET MVC vs ASP.NET Web API

ASP.NET MVC excels at accepting form data and generating HTML. It returns Views and Data. Requests are mapped to action names. MVC features exists in the System.Web.MVC assembly.

ASP.NET Web API excels at accepting and generating structured data like JSON and XML. It returns only Data not View. Build Restful services and supports content type negotiation (response data format can be JSON, XML, ATOM etc). Requests are mapped to actions based on HTTP Verbs. With the Web API, no longer IIS need to be used to host HTTP services, services can be hosted in a custom Windows service, console application, or any other type of host you need. Provides automatic support for OData. The model binding, filters, routing and others MVC features exist in Web API are different from MVC and exists in the new System.Web.Http assembly. Light weight architecture and good for devices like smart phones.