EBernhardson added a comment.

  https://commons-query.wikimedia.org/sparql returns CORS headers  in the same 
way that https://query.wikidata.org/sparql does.
  
  What doesn't work is CORS during the authentication flow, and I'm not sure 
this is something we can change.  I can setup the appropriate CORS headers to 
be returned by the query service when redirecting to auth, but that will 
redirect to 
https://commons.wikimedia.org/wiki/Special:OAuth/authenticate?oauth_token=...  
which will then say:
  
    Access to XMLHttpRequest at 
'https://commons.wikimedia.org/wiki/Special:OAuth/authenticate?oauth_token=...' 
(redirected from 'https://commons-query.wikimedia.org/sparql') from origin 
'https://test.wikipedia.org' has been blocked by CORS policy: No 
'Access-Control-Allow-Origin' header is present on the requested resource.
  
  Changing the CORS headers for Special:OAuth isn't something I can do, that 
would have to go through the security team. It's hard for me to verify that 
would be sufficient, testing with a hacked up chrome extension that lets me 
overwrite request/response headers
  
  I can potentially make it work in cases where the user already has a 
commons-query.wikimedia.org auth token, although right now i'm fighting with 
nginx to convince it to apply SameSite=none to cookies instead of reubiilding 
the application jars.

TASK DETAIL
  https://phabricator.wikimedia.org/T307391

EMAIL PREFERENCES
  https://phabricator.wikimedia.org/settings/panel/emailpreferences/

To: EBernhardson
Cc: EBernhardson, FRomeo_WMF, GFontenelle_WMF, Aklapper, Dominicbm, 
Astuthiodit_1, AWesterinen, karapayneWMDE, Invadibot, MPhamWMF, maantietaja, 
CBogen, ItamarWMDE, Akuckartz, Nandana, Namenlos314, Lahi, Gq86, 
Lucas_Werkmeister_WMDE, GoranSMilovanovic, QZanden, EBjune, merbst, 
LawExplorer, _jensen, rosalieper, Scott_WUaS, Jonas, Xmlizer, jkroll, 
Wikidata-bugs, Jdouglas, aude, Tobias1984, Manybubbles, Mbch331
_______________________________________________
Wikidata-bugs mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to