title: CORS issue on a Delphi's Datasnap ISAPI Module
body: <p>We have a problem with a Datasnap REST (Delphi 10.1 Berlin) Server accessed by AngularJS clients. I can't activate Authorization because Angular can't send the dssession within a Pragma Header, seems to be a problem with CORS, because the browser is the one changing that Header (launching Chrome with the --disable-web-security flat everything runs fine).</p>
  
  <p>Even running Angular and Datasnap on the same machine for testing (Angular at localhost:8080 and Datasnap at localhost:8081), the browser detects the calls as Cross-Origin calls and when Angular tries to send the dssession it doesn't arrive to Datasnap. Note: I allow cross-origin calls using the following: code <a href="http://delphi.org/2015/04/cors-on-datasnap-rest-server/" rel="nofollow">http://delphi.org/2015/04/cors-on-datasnap-rest-server/</a></p>
  
  <p>Running the Server as an StandAlone application I can see in the WebModuleBeforeDispatch event that the TWebRequest gets an Access-Control-Request-Headers with the value "Pragma" instead of the expected Pragma Header, so it looks like the browser is issuing a CORS Options request and Datasnap doesn't answers it (it raises a TDSServiceException with the "command closed or unassigned" message).</p>
  
  <p>I have solved it for the StandAlone application, passing the dssession through the URL (it doesn't interfere with the normal pass of parameters because I only use POST calls from AngularJS), and then intercepting the Request on the WebModuleBeforeDispatch event and manually adding a Pragma Header with the dssession retrieved from the calling URL.</p>
  
  <pre><code>procedure TWebModule1.WebModuleBeforeDispatch(Sender: TObject; Request: TWebRequest; 
                                                Response: TWebResponse; var Handled: Boolean);
  var Token: string;
  begin
    Response.SetCustomHeader('Access-Control-Allow-Origin','*');     // Allow CORS calls
  
    Token := TIdHTTPAppRequest(Request).Query;         // Set session on Pragma from the URL
    if Copy(Token, 1, 10) = 'dssession=' then begin
      TIdHTTPAppRequest(Request).GetRequestInfo.RawHeaders.AddValue('Pragma', Token);
    end;
  
    if FServerFunctionInvokerAction &lt;&gt; nil then
      FServerFunctionInvokerAction.Enabled := AllowServerFunctionInvoker;
  end;
  </code></pre>
  
  <p>It works fine on that StandAlone application, but when I recompile my code as an ISAPI module to deploy it on the final production environment, it doesn't add the dssession Pragma Header on the Requests, probably because it doesn't get the dssession passed through the URL, but I can't be sure of the reason because I can’t get my Delphi to debug that ISAPI Module.</p>
  
  <p>I follow this Tutorial: <a href="http://edn.embarcadero.com/article/40873" rel="nofollow">http://edn.embarcadero.com/article/40873</a> and I can correctly set to run my ISAPI Module, but when I attach the w3wp.exe process to my Delphi debugger it doesn't stop to any break-point (they appear disabled, as like the code was compiled with a Release Build instead of a Debug Build), in fact, the w3wp.exe process seems to be frozen and doesn't attend any call until I detach it from the Delphi debugger.</p>
  
  <p>So, I would appreciate any suggestion to be able to debug that module, and more importantly, to pass the dssession to an ISAPI Module when your browser detects them as Cross-Origin calls.</p>
  
  <p>Thank you very much.</p>