I'm developing a very simple angular 2 app using the angular2/http module to access a rails resource. I'm running both a node development server and the rails development server. The issue I'm having is getting around the same origin policy restrictions on an ajax call to a rails backend.
error:
XMLHttpRequest cannot load http://localhost:3000/people.
Origin http://localhost:8080 is not allowed by Access-Control-Allow-Origin.
My servers are on
http://localhost:8080 //node
http://localhost:3000 //rails
I need clarification how this works:
- Will these services clash if I run them on the same port?
- If you have to run on different domains, how do you do this securely?
- How do admins handle this in production modes when servers are almost certainly going to be on a different port/domain?
Access-Control-Allow-Origin: *to every response, you are telling the browser that anyone can make requests to your server through a different domain. See: developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS and gist.github.com/dhoelzgen/cd7126b8652229d32eb4