CORS For Using API From Browser

[nvzqz]

I'd like to make use of certain crate stats in a blog post by fetching the data from https://crates.io/api/v1/, however there doesn't seem to be CORS support since the endpoints I'd like to use don't respond to OPTIONS requests.

[jtgeibel]

@nvzqz I did a bit of research and as far as I can tell, typical usage of our API shouldn't require a CORS preflight. I'm basing this on https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#Simple_requests.

Do you have more information on the specific errors you're seeing? Sorry, I'm not too familiar with all the cross-origin web constraints.

[thomcc]

... Chiming in on request from nvzqz...

It doesn't need a CORS preflight, but the response from a cross origin request still needs Access-Control-Allow-Origin header allowing the request otherwise the response data isn't shared with the page.

The fetch standard has some good examples: https://fetch.spec.whatwg.org/#cors-protocol-examples, but basically that header isn't optional (otherwise client JS could exfiltrate information from inside private networks and such)

[jtgeibel]

Thanks for the info on Access-Control-Allow-Origin! If anyone wants to open a PR to add this header, the nginx configuration file is probably the best place.