Steps to replicate the issue (include links if applicable):
mw.loader.using('mediawiki.ForeignApi').then(() => { const ajaxOptions = { ajax: { headers: { 'Promise-Non-Write-API-Action': '1', }, }, }; const api = new mw.ForeignApi('https://meta.wikimedia.org/w/api.php', ajaxOptions); api.post({ action: 'query', formatversion: '2', titles: 'Main page', }).then(console.log, console.error); });
What happens?:
The request fails due to a CORS preflight error:
Access to XMLHttpRequest at 'https://meta.wikimedia.org/w/api.php?action=query&format=json&origin=https%3A%2F%2Fja.wikipedia.org&meta=userinfo%7Ctokens' from origin 'https://ja.wikipedia.org' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
GET https://meta.wikimedia.org/w/api.php?action=query&format=json&origin=https%3A%2F%2Fja.wikipedia.org&meta=userinfo%7Ctokens net::ERR_FAILED
Access to XMLHttpRequest at 'https://meta.wikimedia.org/w/api.php?centralauthtoken=[REDACTED]&origin=https%3A%2F%2Fja.wikipedia.org&action=query' from origin 'https://ja.wikipedia.org' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
POST https://meta.wikimedia.org/w/api.php?centralauthtoken=[REDACTED]&origin=https%3A%2F%2Fja.wikipedia.org&action=query net::ERR_FAILED
{
"xhr": {
"readyState": 0,
"status": 0,
"statusText": "error"
},
"textStatus": "error",
"exception": ""
}What should have happened instead?:
The cross-origin POST request should succeed.
Software version (on Special:Version page; skip for WMF-hosted wikis like Wikipedia):
Other information (browser name/version, screenshots, etc.):
The issue occurs specifically when the Promise-Non-Write-API-Action header is present. The same request succeeds if the custom header is removed.