Getting CORS Exception when calling Gigya Rest Api from Screenset Javascript

[shivksingh]

We have a 3 screen registration flow for a user and users Date of Birth is captured at last screen.

Requirement is to delete user if he does not fit into certain age criteria.

We tried to make REST calls from Javascript inside Screen set it gives CORS exception.

Access to fetch at 'https://accounts.us1.gigya.com/accounts.search' from origin 'https://console.gigya.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

Changing the Registration flow or making DOB at first screen is not accepted by client.

Any guidance in this regard will be helpful.

[spu230479]

Hi shivksingh,

In order to use accounts.search client side using our WebSDK you will need to follow the instructions on our developers guide https://developers.gigya.com/display/GD/accounts.search+JS.

This will require a querySig Param to be set. This is a HMAC_SHA1 signature proving that the search call is in fact coming from your client application, in order to prevent fraud. Follow the instructions in Constructing a Signature using the following base-string: query + "_" + expTime.

Because of the sensitive data involved with constructing a signature (i.e., the use of your secret key), it is recommended that the signature not be built in the client side; rather, signatures should be constructed on the server and injected into the script.

Additionally if you were looking to user our Account Deletion API this would need to take place serverside as well. Given the complexities of the requirements you have for your registration flow I'd certainly recommend you engaging with our Professional Services Team.

One way how you could simplify this flow is to utilise Extensions (https://developers.gigya.com/display/GD/Extensions) to perform the Custom Age Validation server side. Additionally you could then use IdentitySync to delete those accounts where registration wasn't completed due to the DOB not being set.

Thanks

Stephen