Listing embeds not working because of CORS
Error
I tried to embed an activity listing from one blog to a gancio instance, both having different names, and CORS errors prevented js code and json info to be loaded into the blog.
Environment
- Gancio v1.4.3
- Installed the docker way
- Hostname: https://bcn.convoca.la
Further
I downloaded the javascript just in case it's some "remote code execution" security measure, but still, this happened:
GET http://bcn.convoca.la/api/events?max=10 CORS Missing Allow Origin
Just in case it has something to do with our server setup, I tried with demo.gancio.org
with no luck too.
Discussion
MDN resources on CORSMissingAllowOrigin say that it's the server who should send a header to the browser stating that it's ok to use that info from any origin.
I guess you already did something similar with RSS feeds in commit ba4a505b
Possible solutions
So, would something like this fix this error?
- Add a wide-open CORS rule to
/gancio-events.es.js
- Add a rule for /api/events
- (quicker) Add wide-open CORS rule to route /api/events
- (longer) Make configurable by UI which domains can use your instance's API