https://bugzilla.wikimedia.org/show_bug.cgi?id=19907

Roan Kattouw <[email protected]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |REOPENED
         Resolution|FIXED                       |

--- Comment #14 from Roan Kattouw <[email protected]> 2011-12-20 14:40:50 
UTC ---
(In reply to comment #13)
> Roan, is your comment 12 something you will be able to get to, or should I
> start a new bug for it?
I'm sorry for the delay, thank you for reminding me. There were serious issues
with the implementation, mostly regarding caching. Those issues would have to
be addressed in MediaWiki before CORS can be enabled for the API.

The root of the caching issue is comment #7: the Access-Control-Allow-Origin
header we send back contains the origin domain of the foreign request, and if
that header gets cached, we're screwed.

Fortunately, there's a way around this if I'm reading this correctly. For
non-credentialed requests, we can send Allow-Origin: * . For credentialed
requests, we have to send Allow-Origin: $ORIGIN and Allow-Credentials: true ,
but we can just set a no caching header for those, as credentialed requests
aren't supposed to be cached anyway.

The catch here is in the definition of "credentialed request". We don't want
this to mean "any request that passes a cookie" because that would be
excessive; rather, we want this to mean "any request that would actually use
the cookie information", i.e. requests with user-specific or privileged things.
Maybe we can tie this to the cache mode?

This is interesting stuff and I have new inspiration for it now :) , so I'll
poke at it today or tomorrow.

-- 
Configure bugmail: https://bugzilla.wikimedia.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

_______________________________________________
Wikibugs-l mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/wikibugs-l

Reply via email to