Watson Services + Cross Origin Resource Sharing

Question

I am developing an application using Watson's Dialog service, where the API is accessed in client-side javascript, but ran into the following problem when trying to access the API.

XMLHttpRequest cannot load https://gateway.watsonplatform.net/dialog/api. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:8000' is therefore not allowed access. The response had HTTP status code 401.

The solution seems to be Cross Origin Resource Sharing, but I cannot find a way to enable this for a Watson service. Is there a way to do this? If not, is there another way around this? I was only able to find resources for enabling it for an application that we deploy ourselves.

If I'm understanding correctly this won't be a problem if our application is deployed to BlueMix, instead of being tested locally. If possible, though, we would like to be able to test locally when possible for speed of development.

Thanks for your help!

Answer 1

The APIs you are calling doesn't allow cross origin request and your browser security is preventing you to use it (To understand the cross origin behaviour look on Mozilla docs about CORS)

To have a workaround for it (perfectly sure avoiding to break your browser's security policies) you could implement an application working as a proxy backend, which will forward to the requested APIs your requests and add all the headers to support CORS settings. This application could run on Bluemix and could be developed on the runtime you wish, nodejs or Java or php etc and then your mobile app should call it instead of APIs directly. Moreover it could allow you to move a lot of business logic from the client to the proxy/backend making the first more light and "agile"

Answer 2

If one wishes to circumvent browser oriented security during development testing, browsers commonly have a mechanism to allow this capability. For example, in the Google Chrome browser, starting the browser with the flag --disable-web-security will disable checking for cross origin requests from the browser end allowing a browser to make REST requests to any back-end server. For example:

chrome --disable-web-security

A warning will be shown in your browser that you are running in this insecure more:

Answer 3

You can test locally by taking your service credentials (VCAP_SERVICES) and adding them to your application. This should be done on your web server as environment variables.

You can check out this readme: https://github.com/watson-developer-cloud/movieapp-dialog

This would work smoothly with the Java SDK check out this: com.ibm.watson.developer_cloud.dialog.v1.DialogService;

or you can use the Node SDK An example for this: https://github.com/watson-developer-cloud/conversational-agent-application-starter-kit/blob/master/api/services.js