Why do I get a 403 forbidden when calling to external IIS based MVC controller returning a JSON result

Question

I have an application that's been provided by a third party. The only means of modifying the behavior is through client side script. I have a screen in the app that does some ad-hoc querying but doesn't provide any means by which to save the settings. Rather than have the user re-enter setting each time, I've injected some elements via jQuery to enable them to save their queries.

I have another internal site that is asp.net MVC that I've added a controller with a method GetQueryList(string User).

From the browser everything work fine, I get my result returned, but from script I get a 403. I've been chasing my tale for two days on this now.

I dumbed down the methods to just get things working.

Here's the controller code:

<AcceptVerbs(HttpVerbs.Get)> _ 
Public Function GetQueryList(ByVal user as String) as JsonResult   
    Return Me.Json(String.format("Hello {0}", user))
End Function

Client code:

    $.getJSON("http://myservername.org/ClientQuery.mvc/GetQueryList",
        null
        , function (data) {
            alert(data);
        }
    );

If anyone has any ideas it might save what little hair I have left.

Answer 1

You get that error because browsers implement a Same Origin Policy that blocks AJAX requests to other domains.

You can create a local AJAX class to proxy the external AJAX request on behalf of the user, using a .NET WebRequest. Note that WebRequest has no constructor and uses a factory method WebRequest.create(Uri) instead.