Find a good description for CORS (Cross-Origin Resource Sharing) at this link:

Learn more about CORS here:

Enabling CORS

To enable CORS on IIS - all sites on the machine:

Add a or change web.config on the root website (Default Web site):

<?xml version="1.0" encoding="utf-8"?>  
    <cors enabled="true" failUnlistedOrigins="true">
      <add origin="*"/>
      <add origin="" allowCredentials="true" >
        <allowHeaders allowAllRequestedHeaders="true"/>

To do this on App level - change Web.config in the same way - but beware that web-config is part of the installation and will be replaced upon update.

Details from the IIS team on how to configure CORS using XML (like above):

To test that CORS is active, you can use this online tool, for example,

Just enter the root URL of your site in "Remote URL".

Contender Implementation - Cors With Dynamic Decisions

To allow dynamic decisions on whom to allow Cors entry, you can now implement this model pattern:

2020-09-16 17h27 21.png

Class named TK_WebCors with a static method GetAllowOrigin(org:String):Boolean

This method will be called when you use RestAllowed Viewmodels and the caller's Origin in small caps will be given in the parameter.

This example returns true for all -> which means that all origins are ok.

A more realistic implementation might be:


The check is cached in an internal Dictionary for 10 minutes - changes will be discovered in 10-minute intervals.

If the model pattern is wrong, you get an exception in the Turnkey log:

CentralLogging("CheckCorsHeaders - check model pattern static TK_WebCors.GetAllowOrigin(vOrigin):string", ex)

NOTE - if you have Cors-middleware in IIS or Cassini, you will not see the effect from the above since middleware will overwrite.

If Cors headers are applied, this is what we apply:

Response.Headers.Add("Access-Control-Allow-Origin", cleanorg);
Response.Headers.Add("Access-Control-Allow-Credentials", "true");
Response.Headers.Add("Access-Control-Allow-Headers", "authorization"); 
Response.Headers.Add("Access-Control-Allow-Methods", "POST, GET"); 
Response.Headers.Add("Vary", "Origin");

You may also send (not recommended due to the open nature of the web) the credentials in the basic authentication scheme:

function myFunction(){
            type: "get",
            url: "http://localhost:5052/TurnkeyRest/Get?command=AutoFormClass1x&id=1!45",
            xhrFields: { withCredentials: true },
            headers: {
                "Authorization": "Basic " + btoa("theuser:thepwd")
        }).done(function (data) {
        }).fail(function (jqXHR, textStatus, errorThrown) {
            $('#value1').text(jqXHR.responseText || textStatus);

Writing to ViewModels from Javascript

Post data to a ViewModel-driven MDriven Form (i.e., not the best way - but rather injecting data into standard UI) - you can proceed like this:

        let formData = new FormData();
        formData.append("Filter", "v");
        fetch('https://YOURTURNKEYSITE/TurnkeyRest/Post?command=AutoFormSysUserSeeker', {
            headers: new Headers(),
            method: "POST",
            mode: 'cors',
            body: formData
        }).then((response) => {
                if (response.ok) {
                    return response.json()
                } else {
            }).then((responseJsonData) => {
                callback && callback(responseJsonData);
            }).catch((error) => {
                console.log("getWatchHistory error " + error);
This page was edited 29 days ago on 06/17/2024. What links here