How to perform an http get request from a browser hosted applicati

Hi all,

just before posting my question I found a solution :-) Anyway I feel that
some others might run into the same issue, so I will post my solution. And
there are a lot of questions open where some experts could provide background
information.

I have a WPF application hosted in a browser accessed by some URL, let's
say: http://localhost/wpftest/BrowserTest.xbap

In the code of this application I want to make an http get request to
another application http://localhost/otherApp. To overcome the security
restriction that limits browser application only to access their own site I
use a redirect on the web server that redirects all calls from a subdirectory
(here named "redirectedsubdir") of the wpftest application to otherApp.

So actually from my BrowserTest application I have to make a get request
like http://localhost/wpftest/redirecteds...&param2=value2
that on the web server gets redirected to
http://localhost/otherApp?param1=value1&param2=value2

To my understanding this should not violate any security resrictions of
browser hosted applications. Now the question is how must the code be written
to make this request? I tried various ways:

So again application URL is http://localhost:8080/wpftest/BrowserTest.xbap

1) use absolute URL:
Uri url = new
Uri("http://localhost:8080/wpftest/redirectedsubdir?param1=value1&param2=value2");
WebRequest request = WebRequest.Create(url);
// request.Credentials = CredentialCache.DefaultCredentials;
HttpWebResponse response = (HttpWebResponse)request.GetResponse();
Stream dataStream = response.GetResponseStream();
StreamReader reader = new StreamReader(dataStream);
string responseFromServer = reader.ReadToEnd();
....

Ok finally this code works. Use this code if you need to perform a web
request from a browser app :-)

The reason it failed for such a long time was the commented line
request.Credentials = CredentialCache.DefaultCredentials;
The code sequence comes from an example code of the SDK doc. If you
uncomment this line the code fails with Security Exception....

System.Security.SecurityException: Request for the permission of type
'System.Security.Permissions.EnvironmentPermission, mscorlib,
Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.
at System.Security.CodeAccessSecurityEngine.Check(Object demand,
StackCrawlMark& stackMark, Boolean isPermSet)
at System.Security.CodeAccessPermission.Demand()
at System.Net.CredentialCache.get_DefaultCredentials()
at BrowserTest.Page1.DoWebRequest()
at BrowserTest.Page1.OnLoaded(Object sender, RoutedEventArgs e)

So the question remains: Is this behavior intended or a bug? At least
documentation should be updated to remove this line for browser based apps
(or even better provide a sample for exactly this, I think it is a common
requirement for browser apps)


2) as 1) but with relative URL
Uri url = new
Uri("/redirectedsubdir?param1=value1&param2=value2",UriKind.Relative);
WebRequest request = WebRequest.Create(url);

fails
System.InvalidOperationException: This operation is not supported for a
relative URI.
at System.Uri.get_AbsoluteUri()
at System.Net.WebRequest.Create(Uri requestUri, Boolean useUriBase)
at System.Net.WebRequest.Create(Uri requestUri)
at BrowserTest.Page1.DoWebRequest()
at BrowserTest.Page1.OnLoaded(Object sender, RoutedEventArgs e)

Question: Why are relative URLs not supported?

3) use pack:siteoforigin
Uri url = new
Uri("pack://siteoforigin:,,,/redirectedsubdir?param1=value1&param2=value2");
Stream stream = Application.GetRemotePart(url).GetStream();
StreamReader reader = new StreamReader(stream);
string responseFromServer = reader.ReadToEnd();

This basically works but the parameters behind ? are not transferred to the
server :-(

If I use code like in 1) with url syntax of 3) I get

System.NotSupportedException: The URI prefix is not recognized.
at System.Net.WebRequest.Create(Uri requestUri, Boolean useUriBase)
at System.Net.WebRequest.Create(Uri requestUri)
at BrowserTest.Page1.DoWebRequest()
at BrowserTest.Page1.OnLoaded(Object sender, RoutedEventArgs e)

Is this "pack:" syntax only supported for Application.GetRemotePart() ? What
is the difference to a WebRequest?

4) My last attempt was to use some Indigo code I adapted from the
amazon/yahoo sample. This required to implement a POXProxy, a
POXMessageEncoder, a POXBindingElement, a POXMessageProperty and a
POXMessageEncoderFactory.... (hey guys, what is this 5 classes for a simple
get request!!! in Javascript this is maybe 10 lines of code ;-)

This works in a desktop application but fails in browser with a
SecurityException as in 1)

Question: what confuses me: Is WebRequest class a legacy class for WinFX and
should be replaced by Indigo code? It is so much easier to use. Or is the
intention of Indigo to be used for different scenarios? What is the preferred
way to communicate with a web server in a browser hosted WPF app?

Hope that my post here might help somebody and perhaps someone might provide
some background information for all these stupid beginner's questions.

Jens

I am not sure but I think you don't need to redirect the http requests,
because the web browser application can access anything from http://localhost.

The WebRequest is not a "legacy" class in WinFX. And Indigo is not working
in web browser applications because of the security restrictions. So you have
two options: use WebRequest or use plain ASMX web services.

--
Valentin Iliescu [MVP C#]


"Jens" wrote:

> Hi all,
>
> just before posting my question I found a solution :-) Anyway I feel that
> some others might run into the same issue, so I will post my solution. And
> there are a lot of questions open where some experts could provide background
> information.
>
> I have a WPF application hosted in a browser accessed by some URL, let's
> say: http://localhost/wpftest/BrowserTest.xbap
>
> In the code of this application I want to make an http get request to
> another application http://localhost/otherApp. To overcome the security
> restriction that limits browser application only to access their own site I
> use a redirect on the web server that redirects all calls from a subdirectory
> (here named "redirectedsubdir") of the wpftest application to otherApp.
>
> So actually from my BrowserTest application I have to make a get request
> like http://localhost/wpftest/redirecteds...&param2=value2
> that on the web server gets redirected to
> http://localhost/otherApp?param1=value1&param2=value2
>
> To my understanding this should not violate any security resrictions of
> browser hosted applications. Now the question is how must the code be written
> to make this request? I tried various ways:
>
> So again application URL is http://localhost:8080/wpftest/BrowserTest.xbap
>
> 1) use absolute URL:
> Uri url = new
> Uri("http://localhost:8080/wpftest/redirectedsubdir?param1=value1&param2=value2");
> WebRequest request = WebRequest.Create(url);
> // request.Credentials = CredentialCache.DefaultCredentials;
> HttpWebResponse response = (HttpWebResponse)request.GetResponse();
> Stream dataStream = response.GetResponseStream();
> StreamReader reader = new StreamReader(dataStream);
> string responseFromServer = reader.ReadToEnd();
> ...
>
> Ok finally this code works. Use this code if you need to perform a web
> request from a browser app :-)
>
> The reason it failed for such a long time was the commented line
> request.Credentials = CredentialCache.DefaultCredentials;
> The code sequence comes from an example code of the SDK doc. If you
> uncomment this line the code fails with Security Exception....
>
> System.Security.SecurityException: Request for the permission of type
> 'System.Security.Permissions.EnvironmentPermission, mscorlib,
> Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.
> at System.Security.CodeAccessSecurityEngine.Check(Object demand,
> StackCrawlMark& stackMark, Boolean isPermSet)
> at System.Security.CodeAccessPermission.Demand()
> at System.Net.CredentialCache.get_DefaultCredentials()
> at BrowserTest.Page1.DoWebRequest()
> at BrowserTest.Page1.OnLoaded(Object sender, RoutedEventArgs e)
>
> So the question remains: Is this behavior intended or a bug? At least
> documentation should be updated to remove this line for browser based apps
> (or even better provide a sample for exactly this, I think it is a common
> requirement for browser apps)
>
>
> 2) as 1) but with relative URL
> Uri url = new
> Uri("/redirectedsubdir?param1=value1&param2=value2",UriKind.Relative);
> WebRequest request = WebRequest.Create(url);
>
> fails
> System.InvalidOperationException: This operation is not supported for a
> relative URI.
> at System.Uri.get_AbsoluteUri()
> at System.Net.WebRequest.Create(Uri requestUri, Boolean useUriBase)
> at System.Net.WebRequest.Create(Uri requestUri)
> at BrowserTest.Page1.DoWebRequest()
> at BrowserTest.Page1.OnLoaded(Object sender, RoutedEventArgs e)
>
> Question: Why are relative URLs not supported?
>
> 3) use pack:siteoforigin
> Uri url = new
> Uri("pack://siteoforigin:,,,/redirectedsubdir?param1=value1&param2=value2");
> Stream stream = Application.GetRemotePart(url).GetStream();
> StreamReader reader = new StreamReader(stream);
> string responseFromServer = reader.ReadToEnd();
>
> This basically works but the parameters behind ? are not transferred to the
> server :-(
>
> If I use code like in 1) with url syntax of 3) I get
>
> System.NotSupportedException: The URI prefix is not recognized.
> at System.Net.WebRequest.Create(Uri requestUri, Boolean useUriBase)
> at System.Net.WebRequest.Create(Uri requestUri)
> at BrowserTest.Page1.DoWebRequest()
> at BrowserTest.Page1.OnLoaded(Object sender, RoutedEventArgs e)
>
> Is this "pack:" syntax only supported for Application.GetRemotePart() ? What
> is the difference to a WebRequest?
>
> 4) My last attempt was to use some Indigo code I adapted from the
> amazon/yahoo sample. This required to implement a POXProxy, a
> POXMessageEncoder, a POXBindingElement, a POXMessageProperty and a
> POXMessageEncoderFactory.... (hey guys, what is this 5 classes for a simple
> get request!!! in Javascript this is maybe 10 lines of code ;-)
>
> This works in a desktop application but fails in browser with a
> SecurityException as in 1)
>
> Question: what confuses me: Is WebRequest class a legacy class for WinFX and
> should be replaced by Indigo code? It is so much easier to use. Or is the
> intention of Indigo to be used for different scenarios? What is the preferred
> way to communicate with a web server in a browser hosted WPF app?
>
> Hope that my post here might help somebody and perhaps someone might provide
> some background information for all these stupid beginner's questions.
>
> Jens
>