IBM Social Business SmartCloud OAuth 2.0 POSTing new events

Question

I am trying to post an event to my IBM Social Business SmartCloud account. I have been able to grant access to the application and get the access and refresh tokens. but when posting the new even I get a 401 error "No 'Access-Control-Allow-Origin' header is present on the requested resource."

    function postEvent(){
    var postString = '{'+
    '"actor": {'+
      '"id": "@me"'+
    '},'+
    '"verb": "post",'+
    '"title": "${share}",'+
    '"content":"This event is my <b>first content</b>",'+
    '"updated": "2012-01-01T12:00:00.000Z",'+
    '"object": {'+
      '"summary": "My Summary",'+
      '"objectType": "note",'+
      '"id": "someid",'+
      '"displayName": "My displayName",'+
      '"url": "mydomain.com"'+
    '}}';
    $.ajax({
      url: 'https://apps.na.collabserv.com/connections/opensocial/basic/rest/activitystreams/@me/@all?format=json&access_token=<access_token>',
      data: postString,
      contentType: 'application/json',
      method: 'POST',
      dataType: 'json', 
      headers: {
              // Set any custom headers here.
              // If you set any non-simple headers, your server must include these
              // headers in the 'Access-Control-Allow-Headers' response header.
              'Content-Type: application/json',
              'Origin': 'https://mydomain.com/',
              'Access-Control-Allow-Headers' :'*',
              'Access-Control-Allow-Origin': '*'
          }
      }).done(function(data) {
          console.log(data);
      });
}

so this is the proxy method using file_get_contents I used to get it working in php, cURL did not work.

$post = file_get_contents('https://apps.na.collabserv.com/connections/opensocial/basic/rest/activitystreams/@me/@all?format=json',FALSE,stream_context_create(array( 'http' => array( 'method' => 'POST', 'header' => "Authorization: Bearer $access_token\r\n". "Content-type: application/json\r\n". "Content-length: " . strlen($json_data) . "\r\n", 'content' => $json_data, ), )));

now the issues is other people can not see my posting even though we're following each other.

got the json structure for embedding a webpage with og tags for a video into my ibm sb activity stream. so the video opens directly in my stream with a thumbnail without linking out in a new window

    $json_data = '{"content":"https://mydomain.com/somevideo/",
    "attachments":[{"objectType":"link",
        "displayName":"My Display Name",
        "url":"https://mydomain.com/somevideo/",
        "summary":"My summary",
        "image":{
            "url":"{thumbnail}/api/imageProxy?url=http%3a%2f%2fmydomain.com%2fsomevideo%2fthumbnail.jpg",
                "alt":"My Display Name"
            },
        "connections":{
            "video":{
                "connections":{"mime-type":"application/x-shockwave-flash"},
            "width":"853",
            "height":"480",
            "url":"https://mydomain.com/somevideo/"
            }
        }
    }
    ]
    }';

and you post to this url: https://apps.na.collabserv.com/connections/opensocial/rest/ublog/@me/@all?format=json

Answer 1

As long as your code is hosted on a different domain than apps.na.collabserv.com you won't be able to access the REST API with JavaScript alone

In this situation, it is the browser blocking you. The cross origin header won't work, because the backend is not configured to enable CORS requests.

You can work around this by accessing the REST API trough an ajax proxy, deployed on the same domain as your page