title: How to handle CORS error in Report Service?
body: <p>I am wokring on angular and rendering the SSRS report in app using <a href="https://www.npmjs.com/package/ngx-ssrs-reportviewer" rel="nofollow noreferrer">package</a>. My app is running on</p>
  <blockquote>
  <p>http://localhost:52698/</p>
  </blockquote>
  <p>and SSRS server is on different domain</p>
  <blockquote>
  <p>http:\ssrsservername\ReportServer.</p>
  </blockquote>
  <p>Report server main page rendered successfully. But when I click on any of reports than it gives me error of same origin.</p>
  <blockquote>
  <p>Refused to display
  'http://servername/ReportServer/Pages/ReportViewer.aspx?%2fSSRS%2fCascadingReport&amp;rs:Command=Render'
  in a frame because it set 'X-Frame-Options' to 'sameorigin'.</p>
  </blockquote>
  <p>That's because I am calling report from different domain as per my research.</p>
  <p>So, doing by some research I came to know that I need to enable CORS policy in SSRS server
  so I changes the global.asax file of SSRS with following code.</p>
  <pre><code> &lt;%@ Application Inherits=&quot;Microsoft.ReportingServices.WebServer.Global&quot; %&gt;
  &lt;%@ Import namespace=&quot;System.Web&quot; %&gt;
  &lt;%@ Import namespace=&quot;System.Security&quot; %&gt;
  
  &lt;script runat=&quot;server&quot;&gt;
  private static bool init;
  private static object lockObject = new object();
  void Application_BeginRequest(object sender, EventArgs e)
  {
  lock(lockObject)
  {
      if (!init)
      {
          HttpContext context = HttpContext.Current;
          HttpResponse response = context.Response;
          string allow = @&quot;Access-Control-Allow-Origin&quot;;
  
          // enable CORS
          response.AddHeader(allow, &quot;http://localhost:52698/&quot;);
          response.AddHeader(&quot;X-Content-Security-Policy&quot;, &quot;default-src *;&quot;);
          response.AddHeader(@&quot;Access-Control-Allow-Credentials&quot;, &quot;true&quot;);
  
          if (context.Request.HttpMethod == &quot;OPTIONS&quot;)
          {
              response.AddHeader(@&quot;Access-Control-Allow-Methods&quot;, &quot;GET, POST&quot;);
              response.AddHeader(@&quot;Access-Control-Allow-Headers&quot;, &quot;Content-Type, Accept, Authorization&quot;);
              response.AddHeader(@&quot;Access-Control-Max-Age&quot;, &quot;1728000&quot;);
              response.StatusCode = 200;
              response.End();
              HttpApplication httpApplication = (HttpApplication)sender;
              httpApplication.CompleteRequest();
          }
          init = true;
      }
      else
      {
          init = false;
      }
  }
  </code></pre>
  <p>}
  </p>
  <p>But still getting error same error. I followed some articles <a href="https://levelup.gitconnected.com/fixing-cors-errors-with-angular-cli-proxy-e5e0ef143f85" rel="nofollow noreferrer">articles</a> and <a href="https://stackoverflow.com/a/38712051/5729812">answers</a> but didn't work for me.</p>
  <p>I am new to this and didn't know what to do now and also don't know whats wrong with configurations.
  What is the correct way to apply CORS policy for SSRS.</p>
  <p>I'd appreciate any help. Thanks!</p>