AngularJS GET Cross Domain with Basic Authentication - angularjs

Question

I'm trying to interrogate a rest service. If I use CURL I can get the data back without issue.
curl -k -X GET -H "Accept: application/json" -u username:password "https://example.com/v1/apps"
However, I've tried several methods for pulling data back using Angular's $http and $resource services and nothing seems to work.
Does anyone have a good example of how to do this with Angular 1.4.6?
It's both a Cross-Domain and Basic Authentication call.
There are so many "like" examples out there, but nothing seems to work.

Answer 1

Hopefully this will save someone else some frustration. A few things were causing the issue.
The certificate on the target site was invalid. They were using a self-signed cert with example.com as the domain.
The call I was using had a capital 'GET' in it, it should be all lower-case.
To solve issue 1, I had to add the server's IP to my hosts with an alias example.com. It's a major hack, but it was necessary to get around the invalid domain issue. I'm working with the server's owners to have a correct cert put in place.
For the call itself, here an example that works. I'm using another service for the auth header. It just base64s the username and password. Replace AuthorizationService.getCredentials() with your favorite base64(username:password) tool. There are several of them out there.
.factory(
'ApplicationDetailService',
[
'$resource', 'AuthorizationService',
function($resource, AuthorizationService) {
return $resource('https://example.com/v1/apps/:id', { id: '#id' },
{
'get' : {
headers: {
Authorization: AuthorizationService.getCredentials()
}
}
}
);
}
]
)
Finally, because the target server wasn't passing back the Access-Control-Allow-Origin: * header in its response. All of the modern browsers to flat out reject the AJAX return.
I was under the assumption that it was an Angular thing, I was wrong. There's a plug-in for Chrome called Access-Control-Allow-Origin: *, I tried that, it failed because CORS needs your domain in the header.
I found a flag for chrome --disable-web-security that tells Chrome to ignore all security. FAIR WARNING: This makes your session very insecure. Only do this for a test environment. Just modify your shortcut to pass the flag in as a parameter to chrome.exe.
With all of that, I was able to get past my issue and continue developing until the server team fixes things on their end.
Best of luck!