Enable CORS access from JavaScript on other domains

[simonw]

This requires extra CORS headers to allow the content-type header and the POST method.

[simonw]

I'm going to enable CORS by default - if you want to disable it you can use a plugin setting.

[simonw]

Some test HTML - pasted into http://htmledit.squarefree.com/ (has to be an HTTP site because HTTPS cannot make CORS requests to localhost):

<textarea></textarea>
<script>
fetch('http://127.0.0.1:8009/graphql/til', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ query: '{ til { totalCount } }' }),
})
  .then(res => res.json())
  .then(res => document.getElementsByTagName('textarea')[0].value = JSON.stringify(res.data));
</script>

[simonw]

This works! Demo: https://iridescent-neat-wolfberry.glitch.me/

fetch('https://datasette-graphql-demo.datasette.io/graphql', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ query: '{ repos { totalCount } }' }),
})
  .then(res => res.json())
  .then(res => document.getElementById('num').innerHTML = res.data.repos.totalCount);