403 response without CORS header

[dnltsk]

Hi,

the example application is unable to handle the WDT responses when wrong APP Key/ID are used because the response has no Access-Control-Allow-Origin header set.

PLAIN URL
https://skywisetiles.wdtinc.com/swarmweb/valid_frames?product=nalowaltradarcontours&format=JSON

CURL
curl -I -X GET 'https://skywisetiles.wdtinc.com/swarmweb/valid_frames?product=nalowaltradarcontours&format=JSON' -H 'Host: skywisetiles.wdtinc.com' -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:49.0) Gecko/20100101 Firefox/49.0' -H 'Accept: /' -H 'Accept-Language: de,en-US;q=0.7,en;q=0.3' --compressed -H 'app_id: INVALID_APP_ID' -H 'app_key: INVALID_APP_KEY' -H 'Origin: http://localhost:8081' -H 'Referer: http://localhost:8081/examples/google.html' -H 'Connection: keep-alive'

I think CORS should be enabled in all responses to let the client application decide how the react on a 403.

[lrobb-zz]

Thanks @teeschke ... we'll work on getting this fixed.

[lrobb-zz]

@teeschke - This should be fixed now.