How to create a self hosted WCF service with CORS enabled?

Question

1.00/5 (1 vote)

See more:

, +

Please show me an example of self hosted WCF service in which CORS(Cross origin resource sharing) is enabled. The WCF can be hosted in a console application.

Posted 3-Dec-15 17:59pm

Vasudevan B

Add a Solution

Comments

Sergey Alexandrovich Kryukov 4-Dec-15 0:54am

I don't think it can possibly make any sense. Web components have such feature as protection from cross-domain requests "same-origin security policy". And CORS provides a safe work-around mechanism based on some standards. But self-hosted service is something totally custom, it does not have to obey any policy. You cannot develop workaround solution for the problem which does not even exist.

By the way, the adequate form of a WCF service on Windows would be a Windows Service.

—SA

Vasudevan B 4-Dec-15 1:47am

Hello SA,

Thank you for your comments. Let me elaborate the problem that I am facing now:
I have a Windows Forms Application which does some calculation (It receives some data from an interface and process it) and I have a web application in which I need the processed information from the Forms Application. So my plan was to create a WCF service as a self hosted service in forms application and to access it from the browser. But I tried few sample codes and none of them worked. Could you please provide me a solution how to overcome this.

Sergey Alexandrovich Kryukov 4-Dec-15 2:06am

Okay, very good. I see no place for CORS. And it's not just "comments"; I provided complete answer for you. Your phrasing suggests that you did not noticed that. Did you?

Any more concerns? If not, please accept it formally. If you have some concerns, you can always ask further questions.

—SA

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Sergey Alexandrovich Kryukov · Accepted Answer · 2015-12-03T19:18:00

Please see my comment to the question.

I got an impression that you have a big confusion, and, in particular, you don't know yourself what cross-domain activity you want to have. Please forgive me if I'm wrong about it, because of some kind of misunderstanding of your question, but than you will have to clarify it.

In all cases, I think you need to get clearer understanding of things. You can learn about same-origin policy, CORS and Web security model in general:
https://en.wikipedia.org/wiki/Same-origin_policy[^],
https://en.wikipedia.org/wiki/Cross-origin_resource_sharing#How_CORS_works[^].

Here, I can only speculate on what you want to achieve, but let's make some initial logical steps. You can read that

This policy prevents a malicious script on one page from obtaining access to sensitive data on another web page through that page's Document Object Model.

Where are those "scripts" and "pages"? Maybe, there is no such thing. But even if you want to have something like that, what "cross-domain" may possibly mean? It may mean that some client sends some request to your custom WCF service. Part of this request could be some URI pointing to some Internet resource placed outside of the domain of your service; and the request implies that your service should deliver this resource on behalf of your client. Even if it is so, how your service, being custom, can be restricted from doing that? In relation to the foreign-domain service, your service is no different from any other client. You can retrieve any accessible resource based on one of the standard protocols using the class System.Net.WebRequest (a concrete class will be determined by the URI, please see WebRequest.Create static methods). That's all.

If you want to reproduce all the Web-specific security policies and then follow the standards related to CORS, you can do it, but it's hard to imagine the reason why would you do it. If I'm missing something, please explain it.

—SA