Currently, the "gitlab-content" tool can be used to load eg. JavaScript and CSS from GitLab on Wikimedia wikis. However, scripts cannot load data files from there (or at least, without workarounds).

In my use case, I would like to load JavaScript and then lazily load a JSON file on demand from https://gitlab.wikimedia.org/msz2001/abusefilter-analyzer/-/tree/deploy The latter I wanted to do with fetch(), so that I can retrieve and process the response.

However, the request is blocked due to it being cross-origin. Here, I'd like to ask for CORS support in the tool.

I imagine it to be implemented in one of two ways. Since the requests contain no credentials, Access-Control-Allow-Origin: * could be hardcoded into responses, so that no additional measures will need to be taked by the clients to be able to fetch from gitlab-content. This is the simpler one.

Alternatively, a similar way to MediaWiki API's is possible, ie. one needs to pass an additional param in the URL with the origin host, which is then included in the response as Access-Control-Allow-Origin header.

For example:

https://gitlab-content.toolforge.org/{REPO}/-/raw/{PATH}?mime={MIME}&maxage={MAXAGE}&origin=en.wikipedia.org

would allow the browser to share the response with a script running on en.wikipedia.org, by including Access-Control-Allow-Origin: en.wikipedia.org.