CODEWITHSUNDEEP
githubcorsgithub-pages
Max
Max

Reputation: 9879

Cross-Origin Resource Sharing on GitHub Pages

Is there a way to enable Cross-Origin Resource Sharing (CORS) for a static page hosted on GitHub Pages to allow cross-origin requests in Javascript?

For example, can we instruct GH Pages somehow to add these HTTP response headers:

Access-Control-Allow-Origin:*  
Access-Control-Allow-Methods:GET,POST
Access-Control-Max-Age: 1000
Access-Control-Allow-Headers:*

Couldn't find anything in their documentation, and this ...

...GitHub Pages does not support customer server configuration files such as .htaccess or .conf...

... doesn't sound very promising - or is there a way?

Upvotes: 60

Views: 45976

Answers (6)

Riot
Riot

Reputation: 16736

At the time of writing, Github Pages no longer provides CORS, but I have been successful by using the https://github.com/gzuidhof/coi-serviceworker script with Github Pages.

Simply include it alongside your HTML and use:

<script src="coi-serviceworker.js"></script>

or

<script src="coi-serviceworker.min.js"></script>

for the minified version. No further configuration is required, and no need for proxies or other external services.

You can easily check if your browser considers your page to be cross origin isolated with window.crossOriginIsolated on the console, to verify this is working as expected.

Upvotes: 1

monsur
monsur

Reputation: 47957

EDIT: Yay! Looks like GitHub Pages now supports CORS: https://twitter.com/invisiblecomma/status/575219895308324864

This can be verified by curling a request to enable-cors.org (which is hosted on GitHub Pages). Running this command: curl -v enable-cors.org > /dev/null returns an Access-Control-Allow-Origin: * header.

There's no way to support CORS on GitHub Pages, though I'd love to see this feature. We host http://enable-cors.org on GitHub Pages, and we can't enable CORS on the site itself :)

Update

As noted by @Styx GitHub Pages now always redirect to HTTPS. So if you want to confirm for yourself that all origins are allowed, for a particular site using GitHub pages, try curl with -L (to follow the redirects that are involved). E.g.:

$ curl -vL square.github.io/okhttp 2>&1 | fgrep -i access-control-allow-origin

Upvotes: 55

Gitesh kumar Jha
Gitesh kumar Jha

Reputation: 347

In my case, I was using a custom domain but I forgot to add the domain while deploying(ng deploy --base-href https://customdomain.com/). Check the network tab in dev-tools and observe the URL to check if it is generating the expected URL or not.

Upvotes: 2

A13X
A13X

Reputation: 436

What I'm getting from having put in a support ticket a few days ago is that CORS requests to GitHub Pages are perfectly fine.

Getting content from another page, which is what the original post seems to be asking about, means that the other page's server has to have CORS requests set up or otherwise it will block your requests. Typically sites have public APIs to work around this issue if there is a real need to get content from them (e.g., MediaWiki for Wikipedia).

Upvotes: 2

Victor
Victor

Reputation: 5131

You can use a CORS proxy.
http://cors.io/ worked for me.

Normal request:

$.getJSON('https://blockchain.info/stats?format=json',function(data){})

Request with proxy (just prepend http://cors.io/? on the url)

$.getJSON('http://cors.io/?https://blockchain.info/stats?format=json',function(data){})

UPDATE: The API doc have been updated, you just need to prefix your url with https://cors.io/?.

Upvotes: 8

James Singleton
James Singleton

Reputation: 69

FYI it looks like GitHub Pages now support CORS (at least in some situations). In this case custom domains with bare URLs (no www or github sub domain). This means using an A record and avoiding their caching CDN.

When I go to enable-cors.org now I see the Access-Control-Allow-Origin: * header returned on all resources (from the network tab of the browser developer tools). In both Chrome and Firefox.

I use this at https://isthetubeonstrike.com to access a JSON file cross domain from a mobile web app. The SSL/TLS is provided by going through CloudFlare BTW.

Upvotes: 6

Related Questions