getting Refused to execute script from '*' because its MIME type ('application/json') is not executable, and strict MIME type che

Question

Please find below my code to get response from confluence rest api:

<script type="text/javascript" src="Scripts/jquery.min.js"></script>
<script>
    $.ajax({
        type: "GET",
        url: "https://blog.xxxxx.com/rest/api/content?type=blogpost&spaceKey=xxxxx&expand=space,body.view,version,container",
        contentType: "application/json; charset=utf-8",
        dataType: "jsonp",
        jsonp: 'jsonp-callback',
        async: false,
        success: function (result) {
            console.log(result);
        },
        error: function (xhr, errorText) {
            console.log('Error ' + xhr.responseText);
        }
    });
</script>

I referred this and this as reference but it did not resolve my isse. I am getting error on console Refused to execute script from 'https://blog.xxxxx.com/rest/api/content?type=blogpost&spaceKey=xxxxx&…d=space,body.view,version,container&callback=jsonpCallback&_=1413187692508' because its MIME type ('application/json') is not executable, and strict MIME type checking is enabled.

I tried with type:post, dataType:json and dataType:jsonp with jsonp: jsonp-callback. None of these worked for me.

In Network tab of chrome developer tools I am getting resposne from confluence but it does not print the same on console or on page.

If I use dataType:json, I am getting an error XMLHttpRequest cannot load https://blog.xxxxx.com/rest/api/content?type=blogpost&spaceKey=xxxxx&expand=space,body.view,version,container. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://localhost' is therefore not allowed access on chrome.

Update Adding mime type application/json for json in IIS does not work.

Updated code

$.ajax({
            type: 'GET',            
            url: 'https://blog.xxxxx.com/rest/api/content?type=blogpost&spaceKey=xxxxx&expand=space,body.view,version,container',   
            dataType: 'jsonp',
            xhrFields: {                
                withCredentials: false
            },
            headers: {
                "Accept" : "application/json; charset=utf-8",
                "Content-Type": "application/javascript; charset=utf-8",
                "Access-Control-Allow-Origin" : "*"
            },
            success: function (result) {
                $('#blog').html(result);
            },
            error: function (xhr, errorText) {
                console.log('Error ' + xhr.responseText);
            }
        });

Still getting the same error.

Response Body

results: [{id:3342352, type:blogpost, title:The stocks that are set to fly (or crash),…},…]
0: {id:3342352, type:blogpost, title:The stocks that are set to fly (or crash),…}
1: {id:3833861, type:blogpost, title:Before earnings season, it's downgrade season,…}
2: {id:3833876, type:blogpost, title:Petrobras - what goes up, must come down,…}
3: {id:3833882, type:blogpost, title:Fishing for Income in the FTSE 100,…}
4: {id:4489219, type:blogpost, title:A Ray of Light Among the Gathering German Gloom,…}
5: {id:4489234, type:blogpost, title:Insider trading falls as buybacks dominate share prices,…}
6: {id:4489241, type:blogpost, title:El Clasico: Nike vs Adidas,…}
7: {id:4489248, type:blogpost, title:Dollar uncertainty exposes investors' complacency,…}
8: {id:4489254, type:blogpost, title:Worst yet to come for the Australian miners,…}
9: {id:4489258, type:blogpost, title:Using Aggregate List Views to Find Lurking Risks,…}
size: 10
start: 0

How do I reolve the issue of MIME type ('application/json') is not executable, and strict MIME type checking is enabled in confluence rest api ???

Answer 1

https://blog.xxxxx.com/rest/api/content?type=blogpost&spaceKey=xxxxx&expand=space,body.view,version,container is returning JSON.

You are telling jQuery to read it as JSONP.

JSON and JSONP are different.

You need to either change the server to respond with JSONP or change the JavaScript to expect JSON.

No 'Access-Control-Allow-Origin' header is present on the requested resource

If you change the client to expect JSON, then you also need to change the server (blog.xxxxx.com) to provide the CORS headers that give the browser permission to ignore the Same Origin Policy.