Calling Progress OE web service using Javascript: Web Servic

Hello,

I'm currently working with another developer on calling one of our OE web services in a mobile app.

This is a SOAP service exposed using the Web Service Adapter using Apache/Tomcat on an Ubuntu server; everything is set up in a standard way (webapps/wsa/wsa1, etc).  This web service adapter is sucessfully handling web service requests from a wide variety of sources (both internal/external to our company) on an hourly basis.

We're using the XMLHttpRequest javascript object to connect to our web service's address, and sending along that object a SOAP request. We realized that we needed to set up CORS for this and modified /etc/apache2/sites-enabled/ to include the

• Allow-Access-Control-Origin HTTP header
• Access-Control-Allow-Methods to include the OPTIONS HTTP method.

Both of these were added to the <VirtualHost ></VirtualHost> directive, (not in a <Directory ></Directory> directive).

This should all be correct, because when we try to post to https://www.xxxx.com/wsa2/wsa1 (invalid directory), we get a 200 OK return status, showing that Apache is happy.

However, when we POST to  https://www.xxxxxxxxxx.com/wsa/wsa1 in any form at all, we apparently hit Tomcat and thus the web services adapter.  We continually get some form of 405 message saying that the OPTIONS request is denied, specifically marked as coming from the Progress Web Services Adapter.

We've done endless fiddling around with with wsa/WEB-INF/web.xml, with no results.

Here is the most irritating thing:  If the javascript below is run via HTML alone in a browser using IE: works fine.  If we change the browser settings so that both SSL3 and TLS1 are disabled, it won't work.  Checked both Apache and Tomcat on our side and they are using SSL3/TLS1.  See no way to force XMLHttpRequest to use SSL3.

Any help, suggestions, and/or pointers would be greatly appreciated.

Thanks

EDIT: We've also tried to use soapclient.js instead of XMLHttpRequest, but we get the same result of 405 that the OPTIONS request was denied. 

This is the Javascript code we're using to send the post request; with appropriate information redacted of course.

function sendRequest()
{
    var httpSocket = new XMLHttpRequest();
    httpSocket.open("POST", "https://www.xxxxxxxxxx.com/wsa/wsa1?targetURI=urn:com:xxxxxx", true);
    httpSocket.setRequestHeader('Content-Type', 'text/xml;charset=UTF-8');
    httpSocket.setRequestHeader('SOAPAction', "post");

    var request = '<?xml version="1.0" encoding="UTF-8"?>\n\n' +
    '<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"' +
    ' xmlns:api="urn:com:xxxxxxxx:xxxxxxxxxxx">' +
        '<soapenv:Header/>' +
        '<soapenv:Body>' +
            ' <api:getAccounts>' +
                ' <api:webServiceID>xxxxxxxx</api:webServiceID>' +
                ' <api:webServicePassword>xxxxxxxxxxx</api:webServicePassword>' +
                ' <api:databaseCode>xxxxxx</api:databaseCode>' +
                ' <api:systemCode>xxxxxxx</api:systemCode>' +
                ' <api:practiceCode>xxxxxxxxx</api:practiceCode>' +
                ' <api:requestedList>xxxxxxxx</api:requestedList>' +
                ' <api:requestedDate>xxxxxxxxxxxx</api:requestedDate>' +
            ' </api:getAccounts>' +
        '</soapenv:Body>' +
    '</soapenv:Envelope>';

    httpSocket.onreadystatechange = function()
    {
        if(httpSocket.readyState == 4)

        {
            return httpSocket.responseText;
        }
    }

    httpSocket.send(request);
}

Here is the relevant apache2 file in the sites-enabled directory

<VirtualHost xxx.xxx.xxx.xxx:443>
    ServerAdmin xxxxxx@xxxxxx.com
    ServerName www.xxxxxxxxxx.com

    DocumentRoot /usr/xxxxxxx/wwwroot
    # Header set Access-Control-Allow-Origin "https://project.mobile.progress.com"
    Header set Access-Control-Allow-Origin "null"
    # Header set Access-Control-Allow-Origin "*"
    Header set Access-Control-Allow-Credentials "true"
    Header set Access-Control-Allow-Headers "content-type,SOAPAction"
    Header set Access-Control-Allow-Methods "OPTIONS, GET, POST, HEAD, PUT, DELETE"