-
Notifications
You must be signed in to change notification settings - Fork 426
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add Access-Control-Allow-Origin: * to JSON responses for anonymous search requests #2186
Comments
Thanks Alf, good call, we like this. |
I believe you need |
We also need to support the OPTIONS request. This is probably best handled with a view decorator or a tween. |
@hubgit @wagoodman rather than wait for us to get this through our queue, I'd recommend setting up a CORS proxy to handle requests to the Hypothes.is API. corsproxy is a good one if you're running Node.js. You could also test with these plubic CORS proxy (though YMMV): Hopefully that'll let you keep hacking while you wait on us. 😸 |
Or make a pull request :-D |
Oh right! or that. 😉 |
I don't think it's necessary to support OPTIONS for GET requests. |
I'd like to be able to search the API for annotations of the current page, in client-side Javascript.
Currently there's no
Access-Control-Allow-Origin: *
header on the JSON response, so it's not possible to call the API from a different domain (unlike via.hypothes.is, which is able to call the API as it's on the same domain).As the search results are sometimes filtered according to the current user, and the
Access-Control-Allow-Origin: *
prevents the response to authenticated requests being read, the header should only be added to anonymous requests (meaning that only non-authenticated requests would be readable cross-domain).I think it needs to be added somewhere around https://github.com/hypothesis/h/blob/master/h/api/views.py#L77
The text was updated successfully, but these errors were encountered: