It looks like we request https://wikidata.beta.wmflabs.org/wiki/Special:EntityData/Q11.json, and instead of directly returning the entity JSON, that redirects to https://m.wikidata.beta.wmflabs.org/wiki/Special:EntityData/Q11.json (mobile subdomain), and we don’t follow that redirect. I don’t really like Special:EntityData redirecting to a different domain, but fixing that sounds like it would be complicated (and involve changes in MobileFrontend, not just Wikibase), so it’s probably best to just follow the redirect.

Well, jQuery would try to follow the redirect, but it doesn’t have the Access-Control-Allow-Origin header set, so it’s blocked by the Same Origin Policy. (That is, https://de.m.wikipedia.beta.wmflabs.org is not allowed to read the https://wikidata.beta.wmflabs.org → https://m.wikidata.beta.wmflabs.org redirect.)

It looks like the redirect is generated in Varnish, see [text-frontend.inc.vcl.erb::mobile_redirect](https://gerrit.wikimedia.org/r/plugins/gitiles/operations/puppet/+/071ebd253b67808cae5ce313b4ef86c865ab3d6c/modules/varnish/templates/text-frontend.inc.vcl.erb#27). We could try to disable it in some ways:

• Set a fake user agent that doesn’t look mobile. User-Agent is not a forbidden header name, so technically this is possible, but I don’t really like it.
• Temporarily set a stopMobileRedirect=true or mf_useformat=desktop cookie. Cookie is a forbidden header name, so I think we’d have to actually set the cookie using the normal browser APIs, and then unset it afterwards. (Does “afterwards” mean immediately after starting the request or only after it finishes? No idea.) I’m not really a fan of this either. How would we even set a cookie for another domain?
• Add ?mobileaction=toggle_view_desktop to the request URL. However, I’m not sure what this is supposed to do, or what other effects it might have.

Alternatively, we could always request the mobile subdomain – it doesn’t seem to redirect desktop clients back to the desktop domain. However, that might mean that we no longer share the cache with other people who use the desktop domain.

I think the best solution would be to add Access-Control-Allow-Origin: * to the mobile domain redirect at the Varnish level.

Change 526627 had a related patch set uploaded (by Lucas Werkmeister (WMDE); owner: Lucas Werkmeister (WMDE)):
[operations/puppet@production] vcl: add Access-Control-Allow-Origin to mobile redirects

https://gerrit.wikimedia.org/r/526627

Change 526627 merged by Ema:
[operations/puppet@production] vcl: add Access-Control-Allow-Origin to mobile redirects

https://gerrit.wikimedia.org/r/526627