[ https://issues.apache.org/jira/browse/COUCHDB-431?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13510769#comment-13510769 ]
Jan Lehnardt commented on COUCHDB-431: -------------------------------------- The squash commits: https://github.com/janl/couchdb/compare/janl:master...janl:squash-cors Note that the whitespace changes are a separate commit. If I could get a +1 each from Benoit and Robert Newson, I’m happy to do parts 3. and 4. from my previous comment. > cors - aka Cross-Origin Resource Sharing support > ------------------------------------------------- > > Key: COUCHDB-431 > URL: https://issues.apache.org/jira/browse/COUCHDB-431 > Project: CouchDB > Issue Type: New Feature > Components: HTTP Interface > Affects Versions: 0.9 > Reporter: James Burke > Assignee: Benoit Chesneau > Priority: Blocker > Attachments: 0001-cors-support.-should-fix-COUCHDB-431-2.patch, > 0001-cors-support.-should-fix-COUCHDB-431.patch, > 0001-cors-support.-should-fix-COUCHDB-431.patch, > 0001-cors-support.-should-fix-COUCHDB-431.patch, > 0001-cors-support.-should-fix-COUCHDB-431.patch, > A_0001-Generalize-computing-the-appropriate-headers-for-any.patch, > A_0002-Send-server-headers-for-externals-responses.patch, > A_0003-Usably-correct-w3c-CORS-headers-for-valid-requests.patch, > A_0004-Respond-to-CORS-preflight-checks-HTTP-OPTIONS.patch, > check_method_cors.patch, cors.html, cors_test.html, test_cors2-1.tgz, > test_cors2.tgz > > > Historically, browsers have been restricted to making XMLHttpRequests (XHRs) > to the same origin (domain) as the web page making the request. However, the > latest browsers now support cross-domain requests by implementing the Access > Control spec from the W3C: > http://dev.w3.org/2006/waf/access-control/ > In order to keep older servers safe that assume browsers only do same-domain > requests, the Access Control spec requires the server to opt-in to allow > cross domain requests by the use of special HTTP headers and supporting some > "pre-flight" HTTP calls. > Why should CouchDB support this: in larger, high traffic site, it is common > to serve the static UI files from a separate, differently scaled server > complex than the data access/API server layer. Also, there are some API > services that are meant to be centrally hosted, but allow API consumers to > use the API from different domains. In these cases, the UI in the browser > would need to do cross domain requests to access CouchDB servers that act as > the API/data access server layer. > JSONP is not enough in these cases since it is limited to GET requests, so no > POSTing or PUTing of documents. > Some information from Firefox's perspective (functionality available as of > Firefox 3.5): > https://developer.mozilla.org/en/HTTP_access_control > And information on Safari/Webkit (functionality in latest WebKit and Safari > 4): > http://developer.apple.com/safari/library/documentation/AppleApplications/Conceptual/SafariJSProgTopics/Articles/XHR.html > IE 8 also uses the Access Control spec, but the requests have to go through > their XDomainRequest object (XDR): > http://msdn.microsoft.com/en-us/library/cc288060%28VS.85%29.aspx > and I thought IE8 only allowed GET or POST requests through their XDR. > But as far as CouchDB is concerned, implementing the Access Control headers > should be enough, and hopefully IE 9 will allow normal xdomain requests via > XHR. -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira