CORS problems around API

[humitos]

We currently support JSONP on APIv2 in the Footer HTML endpoint only.

Supporting JSONP on APIv3 will allow to query the API from different custom domains.

Suggested at #6152

[stsewd]

We shouldn't use jsonp for new code, we should use a CORS solution instead. And for public and read only endpoints.

[humitos]

@stsewd

We shouldn't use jsonp for new code

Why not?

we should use a CORS solution instead

How is that solution?

[stsewd]

jsonp is to get around CORS, we are opening too much with that, I linked this in other of our projects (private). You can read the warning on this project for example https://jpadilla.github.io/django-rest-framework-jsonp/.

This lib is for handling CORS on django https://github.com/adamchainz/django-cors-headers and it's recommended from django rest framework https://www.django-rest-framework.org/topics/ajax-csrf-cors/#cors

[humitos]

Thanks @stsewd for the data!

We already have django-cors-headers installed and it seems that we have been using it already for Ads. Although, I think we can improve its settings and enable it on the API as well.

[humitos]

I'm closing this issue because it's old and it does not adds value to the current situation. We have talked about CORS recently and we are working on the changes required.

[jobisoft]

This was closed without pointing to the current discussion. Where can I follow the progress?

I am not able to access the API from <projectslug>.readthedocs.io and also not from the custom domain setup for the project, and I find no public reference to CORS related hiccups besides this closed issue. Any help is appreciated.