Set Access-Control-Allow-Origin on atom feeds #178230
Replies: 1 comment
-
| 💬 Your Product Feedback Has Been Submitted 🎉 Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users. Here's what you can expect moving forward ⏩ 
 Where to look to see what's shipping 👀 
 What you can do in the meantime 💻 
 As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities. Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐ | 
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Select Topic Area
Bug
Body
Currently, the Access-Control-Allow-Origin header is not set on the various atom feeds (repository {commits, tags, releases}, user activity).
This prevents other sites from fetching these publicly accessible feeds, e.g. News Visualisations in Grafana.
Proposed Fix
Set
Access-Control-Allow-Origin: *on all atom feeds.Security considerations
Unless the Access-Control-Allow-Credentials header is set as to
true(which I am not proposing), responses to requests including credentials (e.g. cookies) won't be made available to the invoking web content by the browser.Also see the this section in the MDN docs.
Beta Was this translation helpful? Give feedback.
All reactions