Take the 2-minute tour ×

I'm having trouble with jquery 2.0.2 and getting it to identify a HTTP 403 status code when calling my API (hosted on the same machine, just like the static web page the call is coming from). From a web page's javascript, I'm doing an $.ajax GET against a /sessions route to check if the user's cookie is currently set, expecting a 403 if no such cookie exists or if it's not valid.

Ajax is being setup ahead of time with the following call:

  setupAjax: ->
      dataType: 'json'
        withCredentials: true)

The API (nginx reverse proxy logs below) correctly returns 403 for an unauthenticated user: - - [06/Jul/2013:22:48:25 -0700] "GET /1/sessions HTTP/1.1" 403 33 "https://foo.localhost.com/" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:22.0) Gecko/20100101 Firefox/22.0"

Firefox agrees:

enter image description here

However when jQuery's xhr error handler is called, the xhr.status code is for some reason always 404, which throws the logic completely off. For example, say I use the CoffeeScript call below, only the 404 handler is ever called, both if I give it a correct route or even a non-existent route (which correctly returns 404 in both server logs and Firefox)

  checkSessionCookie: ->
      url: "#{@baseUrl}/sessions"
      type: 'GET'
        403: -> console.log "I'm a 403"
        404: -> console.log "I'm a 404")

(dump of xhr object in console):

Object { readyState=4, status=404, statusText="error"}

What's going on here? Did I misconfigure jQuery or am I misusing it somehow? Is there a trick here?

share|improve this question
What kind of script is this, exactly? It doesn't look like javascript to me; you should add the correct tag to your question. –  Daedalus Jul 7 '13 at 6:39
He does mention coffee script in it? –  Owen Melbourne Jul 7 '13 at 8:34
Check permissions? Rule of thumb for correct permissions: Folders: 755 Static Content: 644 Dynamic Content: 700 –  Austin Pray Jul 7 '13 at 10:29
add comment

1 Answer

up vote 0 down vote accepted

Based on some experimentation it seems that Firefox might have been swallowing up CORS exceptions causing the incorrect status. Chrome was always reporting the CORS call which is why I was testing this with Firefox.

Setting CORS headers on the server made Firefox return 403 correctly.

share|improve this answer
add comment

Your Answer


