CORS issue in OpenLayers 2 viewer

[letmaik]

I'm trying to display https://raw.githubusercontent.com/chrisfinch/over9k/master/public/experiments/march-2013/GBR_adm2.json as a GeoJSON resource. In the GeoJSON tab I get the correct map. But in the Map viewer tab which is displayed first (why are there two anyway here?) I get this error in the browser console:

XMLHttpRequest cannot load https://raw.githubusercontent.com/chrisfinch/over9k/master/public/experiments/march-2013/GBR_adm2.json.
Request header field X-Requested-With is not allowed by Access-Control-Allow-Headers in preflight response.

Note that I deliberately do not use resource_proxy since I only want to support resources with proper CORS headers, which in this case above it has.

[letmaik]

This also happens with WMS for many servers. The reason is that OpenLayers 2 adds to every request the header X-Requested-With: XMLHttpRequest for no good reason (see code: https://github.com/openlayers/openlayers/blob/master/lib/OpenLayers/Request.js#L180). However, this is a massive problem when doing cross-domain requests, since by default you are only allowed to set the following headers: Accept, Accept-Language, Content-Language, Last-Event-ID, Content-Type. Any other headers will automatically trigger a CORS pre-flight request to the server by the browser itself. And this is simply an OPTIONS request asking the server if it's ok to use that header. And since many WMS servers don't support OPTIONS it just fails, and there's no good reason to support it anyway. jQuery doesn't send the X-Requested-With when doing cross-domain requests, which is the right way to do it. And OpenLayers 3 doesn't include a request facility like that anymore, so you would use something else anyway.

There are several ways to solve this issue:

• file a bug in OpenLayers 2 and hope for a new release
• patch the included version in geoview directly
• update to OpenLayers 3

[amercader]

See https://github.com/ckan/ckanext-geoview/pull/31#issuecomment-210384999