title: CORS authenticated requests to Google Sites feed/API blocked
body: <p>I'm currently building an ASP.NET web application to simplify the provisioning of Google Sites, pages, Gadgets on Google Sites and ACLs for Google Sites.</p>
  
  <p>I have encountered the issue which many a developer has already come across: cross-origin resources. According to the Google documentation on CORS requests to Google APIs, you simply use an XMLHttpRequest (or AJAX) request, providing your access token in the header. More information can be found here:</p>
  
  <p><a href="https://developers.google.com/api-client-library/javascript/features/cors" rel="nofollow noreferrer">https://developers.google.com/api-client-library/javascript/features/cors</a></p>
  
  <p>I've been perfectly able to accomplish this when I'm accessing the Google Sites API from within my domain on Google Sites, injecting AJAX requests while my browser window's location is within the domain. An example of a succeeded request to make a new site from within my domain: </p>
  
  <pre><code>$.ajax(
  {
      ////// REQUEST \\\\\\
      type: "POST",
      url: "https://sites.google.com/feeds/site/[domainName]",
      contentType: "application/atom+xml",
      headers: {
          "Authorization": "Bearer " + [accessToken],
          "GData-Version": "1.4"
      },
      data: ["&lt;entry xmlns='http://www.w3.org/2005/Atom' xmlns:sites='http://schemas.google.com/sites/2008'&gt;",
                 "&lt;title&gt;What a site&lt;/title&gt;",
                 "&lt;summary&gt;Best description ever.&lt;/summary&gt;",
                 "&lt;sites:theme&gt;ski&lt;/sites:theme&gt;",
             "&lt;/entry&gt;"].join(""),
  
      ////// LOGGING \\\\\\
      beforeSend: function () {
          console.log('-------Making-the-request-------');
      },
      success: function (result) {
          console.log(result);
      },
      error: function (xhr, ajaxOptions, thrownError) {
          console.log(thrownError);
          console.log(xhr.status);
      }
  });
  </code></pre>
  
  <p>(In several cases below, I'm writing https:// as [https] due to my account still being restricted to 2 links in a post).</p>
  
  <p>At this point everything was going great, I thought I had everything set to use the code into my ASP.NET site. Alas, things don't always go to plan. When I executed the exact same AJAX call from within my application (right now still hosted on [https]localhost:44301), I get the following error:</p>
  
  <blockquote>
    <p>XMLHttpRequest cannot load
    [https]sites.google.com/feeds/site/[censored] Response to preflight
    request doesn't pass access control check: No
    'Access-Control-Allow-Origin' header is present on the requested
    resource. Origin '[https]localhost:44301' is therefore not allowed
    access. The response had HTTP status code 405.</p>
  </blockquote>
  
  <p>The usual CORS error. I was surprised though, as the advised way of making requests to Google APIs is exactly that. I've also found an article about using CORS with the Google Cloud API:</p>
  
  <p><a href="https://cloud.google.com/storage/docs/cross-origin" rel="nofollow noreferrer">https://cloud.google.com/storage/docs/cross-origin</a></p>
  
  <p>In the article it states:</p>
  
  <blockquote>
    <p>Most clients (such as browsers) use the XMLHttpRequest object to make
    a cross-domain request. XMLHttpRequest takes care of all the work of
    inserting the right headers and handling the CORS interaction with the
    server. This means you don't add any new code to take advantage of
    CORS support, it will simply work as expected for Google Cloud Storage
    buckets configured for CORS.</p>
  </blockquote>
  
  <p>Of course, this isn't the Google Sites API, but I find it hard to believe that Google hasn't implemented the same functionality in all of their APIs.</p>
  
  <p>Does anyone know whether it's possible to achieve successful requests such as this from within a standalone ASP.NET application? And if so, how?</p>
  
  <p>Many thanks for spending time to read about my hardships.</p>
  
  <p><strong>UPDATE:</strong></p>
  
  <p>I've contacted Google Apps Support regarding my issue, and have gotten the following response:</p>
  
  <blockquote>
    <p>In addition to the information you provided, I also reviewed your post
    at
    <a href="https://stackoverflow.com/questions/36840309/cors-authenticated-requests-to-google-sites-feed-api-blocked">CORS authenticated requests to Google Sites feed/API blocked</a>.
    The note at
    <a href="https://developers.google.com/google-apps/sites/docs/1.0/developers_guide_java#SiteFeedPOST" rel="nofollow noreferrer">https://developers.google.com/google-apps/sites/docs/1.0/developers_guide_java#SiteFeedPOST</a>
    only reinforces the statement under 'Can I create a new Google Site?'
    and 'How do I copy a site?' at
    <a href="https://developers.google.com/google-apps/sites/faq#Getting__Started" rel="nofollow noreferrer">https://developers.google.com/google-apps/sites/faq#Getting__Started</a>,
    which states 'Google Apps users can use the site feed to ...' However,
    I don't see why this is relevant to your issue, if you've authorised
    against your domain administrator account, as the note is only
    indicating that gmail.com users won't be able to use the listed
    methods to create, or copy a site.</p>
    
    <p>I haven't used CORS, so can't comment on it's operation, but have been
    able to successfully list, and create sites using HTTP GET and POST
    requests via a raw HTTP client, so the API is operating as it should
    with regard to cross domain requests. I used the sample XML document
    at
    <a href="https://developers.google.com/google-apps/sites/docs/1.0/developers_guide_protocol#SitesFeedPOST" rel="nofollow noreferrer">https://developers.google.com/google-apps/sites/docs/1.0/developers_guide_protocol#SitesFeedPOST</a>
    to create my site, configuring the client with credentials for my
    Developer console project. The fact that the request only fails in
    your ASP.NET site implies that there is something in that environment
    which isn't configured correctly. Unfortunately that's outside my
    scope of support, so I'm unable to provide any specific advice, other
    than to check the relevant documentation, or post a request in the
    ASP.NET section of Stack Overflow at
    <a href="https://stackoverflow.com/questions/tagged/asp.net">https://stackoverflow.com/questions/tagged/asp.net</a>.</p>
  </blockquote>