Enable CORS for ColdFusion Services
Just a quick tip. CORS is a way to allow remote JavaScript clients to use your fancy APIs. Only the best APIs support it now, but usage is growing. For a good introduction to the topic, see Brian Rinaldi's excellent blog post here: Getting HTML5 Ready - CORS. Enabling CORS may be done at the web server level, but if you don't have access to that, or if you want to specifically provide access to one particular CFC file (or method), here is how you can do it.
I've got a CFC with 2 simple methods. Don't worry about what they do - they are just samples. To allow for CORS, you can add one simple header to your code. Unfortunately, you can't do cfheader in script-based CFCs. Therefore I made a new file, head.cfm, with one line:
Obviously if you use tag-based CFCs this won't be a problem. Also note you can move that include (or the tag) into a method to enable CORS only for some methods and not others.
Hope this helps!
Thanks for the tip! FYI, you can set headers in cfscript by using GetPageContext() function as follows:
GetPageContext().getResponse().addHeader("Access-Control-Allow-Origin","*");
Actually - just checked the docs - and they are pretty good. They even mention that the methods are "mandated by the JSP specification" which is pretty clear, too!
<!--- CORS - Cross Origin Resource Sharing --->
<cfheader name="Access-Control-Allow-Origin" value="*" />
<cfheader name="Access-Control-Allow-Methods" value="GET,PUT,POST,DELETE" />
<cfheader name="Access-Control-Allow-Headers" value="Content-Type" />
<cfheader name="Content-Type" value="application/JSON; charset=utf8" />
<!--- Force cache to clear --->
<cfset headerTime=GetHttpTimeString(now()) />
<cfheader name="Cache-Control" value="must-revalidate" />
<cfheader NAME="Pragma" value="no-cache" />
<cfheader name="Expires" value="#headerTime#" />
<cfheader NAME="Last-Modified" value="#headerTime#" />
<!--- THWART Click-Jacking --->
<cfheader name="X-FRAME-OPTIONS" value="DENY" />
<!--- Force IE8 Compatibility mode --->
<cfheader name="X-UA-Compatible" value="IE=EmulateIE8" />
header name="Access-Control-Allow-Origin" value="*";
so you can put it directly into your script-based CFC.
Hopefully Adobe will add more tags to cfscript in CF11?