Agreed on discouraging (or at least not actively encouraging) the use of JSONP. Everything I've read on it has started with big "Do not try this at home!" warnings.
I also very strongly agree on built-in support for CORS, especially elements of DRF getting more tightly integrated into the core. I think CORS is an absolutely essential component if Django is going to claim to be able to support a REST API out of the box, primarily because of the trend of using domain.com for an app, and api.domain.com for the backend. -Joey On Tue, Apr 19, 2016 at 6:59 AM, Tom Christie <[email protected]> wrote: > JSONP is essentially a browser hack. > There have been security issues raised around it, and we I don't believe > we should encourage its usage by including it in Django core. > (If anything we *might?* want to consider CORS for built-in support at > some point.) > I'd agree with Florian here - I'd rather see this as either a third party > package, a code snippet that's shared on a blog post, or similar. > > - Tom > > -- > You received this message because you are subscribed to the Google Groups > "Django developers (Contributions to Django itself)" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To post to this group, send email to [email protected]. > Visit this group at https://groups.google.com/group/django-developers. > To view this discussion on the web visit > https://groups.google.com/d/msgid/django-developers/37f473d0-8654-4774-82aa-adaf23ea49ab%40googlegroups.com > <https://groups.google.com/d/msgid/django-developers/37f473d0-8654-4774-82aa-adaf23ea49ab%40googlegroups.com?utm_medium=email&utm_source=footer> > . > For more options, visit https://groups.google.com/d/optout. > -- You received this message because you are subscribed to the Google Groups "Django developers (Contributions to Django itself)" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. Visit this group at https://groups.google.com/group/django-developers. To view this discussion on the web visit https://groups.google.com/d/msgid/django-developers/CADBkHd%2BAwWALAGg4Upy6vA31tZqd1Xt5s5_ESpvYx-koV4agbg%40mail.gmail.com. For more options, visit https://groups.google.com/d/optout.
