Allow cross origin [CORS]

[tetreum]

Hi, my app is JS only and twitch api doesn't have cross origin header, so i can't make requests.
header('Access-Control-Allow-Origin:*');

[WolfWings]

Twitch supports the JSONP mechanism, which avoids any issues of CORS by utilizing callbacks instead. Here's a minimal function to make using this approach easier; I've been using with good success so far. It's based on a stripped-down version of the library at erikarenhill/Lightweight-JSONP@2dbd3af

/*
* Usage:
* 
* JSONP( 'someUrl.php?param1=value1', function(data) {
*   //do something with data, which is the JSON object retrieved from someUrl.php
* });
*/
var JSONP = (function(){ 'use strict';
    var counter = 0;

    var memoryleakcap = function() {
        if (this.readyState && this.readyState !== "loaded" && this.readyState !== "complete") { return; }

        try {
            this.onload = this.onreadystatechange = null;
            this.parentNode.removeChild(this);
        } catch(ignore) {}
    };

    return function(url, callback) {
        var uniqueName = 'callback_json' + (++counter);

        var script = document.createElement('script');
        script.src = url + (url.toString().indexOf('?') === -1 ? '?' : '&') + 'callback=' + uniqueName;
        script.async = true;

        window[ uniqueName ] = function(data){
            callback(data);
            window[ uniqueName ] = null;
            try { delete window[ uniqueName ]; } catch (ignore) {}
        };

        script.onload = script.onreadystatechange = memoryleakcap;

        document.getElementsByTagName('head')[0].appendChild( script );

        return uniqueName;
    };
}());

[bogglez]

+1 for adding CORS support. I will not use JSONP out of security concerns.
Please read this and reconsider adding support, it's a one-liner:
http://en.wikipedia.org/wiki/Cross-origin_resource_sharing#CORS_relationship_to_JSONP

[bogglez]

Is this a no?

[averetennikov]

Please adding CORS support.
JSONP very uncomfortable and old technology

[msmollin]

I'm going to cautiously +1 this. However, for those of you watching this, even though IE 8 & 9 implement CORS support, there are some pretty serious limitations/issues with that implementation. You can read about it here -
http://blogs.msdn.com/b/ieinternals/archive/2010/05/13/xdomainrequest-restrictions-limitations-and-workarounds.aspx

So even though "modern" browsers support it, unless Twitch drops support on the API for IE 8 & 9, we probably will be stuck with JSON-P for now.

[bogglez]

You can have support for both. All that needs to be done is add one single line to the webserver config file and this issue is resolved. Developers can use CORS and use unsafe JSONP on IE. Absolutely nothing changes. The way this issue is handled is so ridiculous that I gave up on an app depending on this.

[Spiffyk]

I totally +1 this issue. Even though my app does not really depend on CORS, I'd really rather not use JSON-P. I hope I won't have to.

[WolfWings]

In this case, it really is a matter of 'blame MicroSoft (yet again) for why the shiny new feature can't be used' due to as mentioned: IE8 and IE9.

Supporting both JSON-P AND JSON+CORS would cause most websites that attempt to integrate with Twitch to fail to integrate for any users using IE8/9 because web-developers would just grab JSON+CORS and stop testing, as JSON-P is more difficult for most web-developers to use as they have to deal with the callback mechanics.

As IE8/9 is approximately 25% of the web-browsers out there still I see why supporting JSON+CORS is a non-starter and likely to remain so for quite some time.

[Spiffyk]

But that is the web-developers' concern, how they will treat different browsers, no? If they want or have to, they will make their app support IE. If they don't... well then the apps just won't work under IE8/9. And also... you can't blame Microsoft, they've got their updated versions of IE. Blame the users that won't upgrade or go to a different browser even when it's free and is a matter of a few clicks.

[WolfWings]

It's more a matter of Twitch forcing streamers and developers of websites to use the technology most compatible with the browsers Twitch themselves choose to support: IE8/IE9 are on that list, and the easiest way to force developers to support these is by only supporting the interfaces that work with IE8/IE9 as well since those interfaces ALSO work with all other browsers and platforms.

You're using the Twitch service, so it's no longer up to you to decide what browsers you support: You support the ones they do, in effect. It's not in the interest of Twitch to lose control over what browsers they choose to support, and JSONP is needed to do that so why support two different interfaces?

[martijnhoekstra]

+1

[tetreum]

Developers do what they want, thats why they're developers. So i'm using YQL to bypass CORS issue.