iandees/xapi-servlet — Issue #22: Cross-origin requests (CORS) headers
Author: samatjain
Created: 2012-03-02 00:09:55+00:00
State: open

Now that JXAPI supports JSON, Web applications running from within a Web browser can make requests to JXAPI directly. Unfortunately, cross-domain restrictions prevent this from working.

CORS headers tell a Web browser that it's OK to make a request to a service running on a different domain.

See [enable-cors.org](http://enable-cors.org/) and the [W3C specification](http://www.w3.org/TR/cors/) for more information.

In theory, the minimum you need is:

Access-Control-Allow-Origin: *

This will allow _any_ Web application running on any domain to connect to a JXAPI instance. It's a good idea to have an option where people running JXAPI instances can specify the value for this header so they can restrict access.

A complication (mentioned in the spec): Web browsers perform a "pre-flight request" to check whether a URL supports CORS. This is usually an HTTP OPTIONS request, followed by a GET/POST/whatever if access is allowed.