issue with Javascript and MTGOX: Request header field Rest-Sign is not allowed

[marcomagno]

Hi, I have been a silent reader of the forum for long, until today when, after hours of trying and failing I am asking you guys help with the following:

I have written the following javascript code, on the basis of what read under post:
https://bitcointalk.org/index.php?topic=164404.0:

Code:

function auth() {
var RestKey= 'my API KEY';
var tonce = microtime();
var secret = 'my secret';

var message = 'BTCUSD/money/info' + '\0';
var RestSign = hmac_512(message,secret);
var path = 'https://data.mtgox.com/api/2/BTCUSD/money/info/';
var result = $.ajax({
                        url: path,
                        headers:{'tonce': tonce, 'Rest-Key': RestKey, 'Rest-Sign': RestSign},
                        type: 'POST',
                        success: function (data) {console.log(data);}
                        }); 
}

where hmac_512 is calculated with jsSHA:

Code:

function hmac_512(message, secret) {
    var shaObj = new jsSHA(message, "TEXT");
    var hmac = shaObj.getHMAC(secret, "B64", "SHA-512", "B64");
    return hmac;
}

the issue is that i keep getting the following error. I think I have tried all possible combinations, but no success:

OPTIONS https://data.mtgox.com/api/2/BTCUSD/money/info/ Request header field Rest-Sign is not allowed by Access-Control-Allow-Headers. jquery.min.js:4

XMLHttpRequest cannot load https://data.mtgox.com/api/2/BTCUSD/money/info/. Request header field Rest-Sign is not allowed by Access-Control-Allow-Headers.

I wanted to post this under the original post, but I am a Newbie, so...

Thanks in advance to any helpful soul that could take me out of my misery...

[zappak]

http://stackoverflow.com/questions/3506208/jquery-ajax-cross-domain

StackOverflow says use JSONP

(Very probable that what you are trying to do will never work unless you run the code from the mtgox.com domain.)

[marcomagno]

Thanks zappak. Tried this too. It appears this is forcing some call-back that bypasses the Access Control Allowed Origin.

My issue is that the MTGOX API server does not allow me to attach headers, it appears!

Any other idea?

[zappak]

Usually when I'm stuck like that I sleep on it. Often the subconscious will shake something loose. My best advice: dream code!