EBernhardson added a comment.
https://commons-query.wikimedia.org/sparql returns CORS headers in the same way that https://query.wikidata.org/sparql does. What doesn't work is CORS during the authentication flow, and I'm not sure this is something we can change. I can setup the appropriate CORS headers to be returned by the query service when redirecting to auth, but that will redirect to https://commons.wikimedia.org/wiki/Special:OAuth/authenticate?oauth_token=... which will then say: Access to XMLHttpRequest at 'https://commons.wikimedia.org/wiki/Special:OAuth/authenticate?oauth_token=...' (redirected from 'https://commons-query.wikimedia.org/sparql') from origin 'https://test.wikipedia.org' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. Changing the CORS headers for Special:OAuth isn't something I can do, that would have to go through the security team. It's hard for me to verify that would be sufficient, testing with a hacked up chrome extension that lets me overwrite request/response headers I can potentially make it work in cases where the user already has a commons-query.wikimedia.org auth token, although right now i'm fighting with nginx to convince it to apply SameSite=none to cookies instead of reubiilding the application jars. TASK DETAIL https://phabricator.wikimedia.org/T307391 EMAIL PREFERENCES https://phabricator.wikimedia.org/settings/panel/emailpreferences/ To: EBernhardson Cc: EBernhardson, FRomeo_WMF, GFontenelle_WMF, Aklapper, Dominicbm, Astuthiodit_1, AWesterinen, karapayneWMDE, Invadibot, MPhamWMF, maantietaja, CBogen, ItamarWMDE, Akuckartz, Nandana, Namenlos314, Lahi, Gq86, Lucas_Werkmeister_WMDE, GoranSMilovanovic, QZanden, EBjune, merbst, LawExplorer, _jensen, rosalieper, Scott_WUaS, Jonas, Xmlizer, jkroll, Wikidata-bugs, Jdouglas, aude, Tobias1984, Manybubbles, Mbch331
_______________________________________________ Wikidata-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected]
