Subject: [weirds] CORS and/or JSONP >

From: Ray Bellis <[email-masked]>
Date: Tue, 12 Mar 2013 15:08:54 +0000

To allow for an RDAP client to run in a browser, the "cross origin" security features in the browser would require either:

1.  all requests go to the same server as the page was loaded from, or

2.  the server wraps the output with a JSONP callback, or

3.  the server sets a response header of "Access-Control-Allow-Origin: *"

where IMHO the latter is preferred.

Is this something that should be mentioned in the JSON response document?

Ray

---

From: Andy Newton <[email-masked]>
Date: Tue, 12 Mar 2013 16:36:14 +0000

On 3/12/13 11:08 AM, "Ray Bellis" <[email-masked]> wrote:

>To allow for an RDAP client to run in a browser, the "cross origin"
>security features in the browser would require either:
>

Are you suggesting some appendix material for browser-based client
implementers?

-andy

---

From: Ray Bellis <[email-masked]>
Date: Tue, 12 Mar 2013 16:41:44 +0000

> Are you suggesting some appendix material for browser-based client

Actually the advice would need targeting at _server_ implementers, not clients.

I just tried APNIC's test RDAP server.  Since it doesn't send the appropriate header a browser-based client would refuse to accept the answers from it.

The alternative would be relaying everything through an RDAP broker, such that the client only ever talks to the broker (which sets the relevant header), and the broker does the real RDAP query.

Ray

---

From: Byron Ellacott <[email-masked]>
Date: Wed, 13 Mar 2013 02:14:35 +0000

Hi Ray,

On 13/03/13 2:41 AM, "Ray Bellis" <[email-masked]> wrote:

>I just tried APNIC's test RDAP server.  Since it doesn't send the
>appropriate header a browser-based client would refuse to accept the
>answers from it.

We're now sending "Access-Control-Allow-Origin: *" on 200, 404, and
(catchable!) 500s.  Does it look right to you?

I prefer ACAO to JSONP for this, but I'm actually not sure on how
widespread support for ACAO is.

  Byron

---

From: Ray Bellis <[email-masked]>
Date: Wed, 13 Mar 2013 12:06:34 +0000

> (catchable!) 500s.  Does it look right to you?

Yes, thanks, it does!

> widespread support for ACAO is.

Me neither - ACAO is definitely superior though.

Ray