Page MenuHomePhabricator

CORS docs for MediaWiki Web API?
Closed, ResolvedPublic

Description

I can't seem to find docs for using CORS in client-side JavaScript with MediaWiki's Web API. I looked at [[mw:CORS]].


Version: 1.22.0
Severity: normal
URL: https://www.mediawiki.org/wiki/Manual:CORS

Details

Reference
bz55928

Event Timeline

bzimport raised the priority of this task from to Medium.Nov 22 2014, 2:19 AM
bzimport set Reference to bz55928.
bzimport added a subscriber: Unknown Object (MLST).

I started [[mw:Manual:CORS]] using an example that Roan posted at bug 20814 comment 15. Would be nice if someone who actually knew how this worked could improve it :)

(In reply to Kunal Mehta (Legoktm) from comment #2)

I started [[mw:Manual:CORS]] using an example that Roan posted at bug 20814
comment 15. Would be nice if someone who actually knew how this worked could
improve it :)

I added a snippet example.

https://www.mediawiki.org/wiki/API:Cross-site_requests https://www.mediawiki.org/wiki/Manual:CORS https://www.mediawiki.org/wiki/Snippets/Cross-wiki_editing_with_CORS https://www.mediawiki.org/w/api.php says this:

origin - When accessing the API using a cross-domain AJAX request (CORS), set this to the originating domain. This must be included in any pre-flight request, and therefore must be part of the request URI (not the POST body). This must match one of the origins in the Origin: header exactly, so it has to be set to something like http://en.wikipedia.org or https://meta.wikimedia.org. If this parameter does not match the Origin: header, a 403 response will be returned. If this parameter matches the Origin: header and the origin is whitelisted, an Access-Control-Allow-Origin header will be set.

centralauthtoken - When accessing the API using a cross-domain AJAX request (CORS), use this to authenticate as the current SUL user. Use action=tokens&type=centralauth on this wiki to retrieve the token, before making the CORS request. Each token may only be used once, and expires after 10 seconds. This should be included in any pre-flight request, and therefore should be included in the request URI (not the POST body).

What else is needed?