Github API 和 Access-Control-Allow-Origin [英] Github API and Access-Control-Allow-Origin
问题描述
这可能是一个简单的(一系列)问题，但我无法理解它.
this probably is a simple (series of) question(s) but I can't wrap my head around it.
我正在尝试从我网站上托管的网络应用程序访问 github api.简而言之，这是代码:
I'm trying to access the github api from a web app hosted on my site. This is the code in a nutshell:
<!DOCTYPE html>
<html>
<head>
<style>p { color:red; }</style>
<script src="http://code.jquery.com/jquery-latest.js"></script>
<script>
$(document).ready(function () {
$.ajax( {url :'https://api.github.com/repos/janesconference/kievIIPlugins/commits', dataType: "json", cache: false, success: function (data, textStatus, jqXHR)
{
var lastCommitSha = data[0].sha;
$("p").text("Last commit SHA: " + lastCommitSha);
}
});
});
</script>
</head>
<body>
<p>Ajax request not (yet) executed.</p>
</body>
</html>
如果我将浏览器指向在我的 Dropbox 帐户上上传的这个简单页面一切都好.相反，如果我将浏览器指向 在我的网站上 上传的这个简单页面，我会得到臭名昭著的 Access-Control-Allow-Origin 异常:
If I point my browser to this simple page uploaded on my dropbox account everything is ok.
If, instead, I point my browser to this simple page uploaded on my site, I get the infamous Access-Control-Allow-Origin exception:
XMLHttpRequest cannot load https://api.github.com/repos/janesconference/kievIIPlugins/commits?_=1360060011783. Origin http://bitterspring.net is not allowed by Access-Control-Allow-Origin.
所以，问题:
- 为什么它可以在 Dropbox 上运行?
- 我了解使用 CORS 甚至可以在网站上使用.这是将
Access-Control-Allow-Origin: *.github.com放在我的 Apache 配置或类似的东西上的问题.但是，正如 en.wiki 所引用的，
- Why does it work on Dropbox?
- I understand that with CORS it would work even on the website. This is a matter of putting
Access-Control-Allow-Origin: *.github.comon my Apache configuration or something like that. But, as quoted from en.wiki,
但是，这可能不适合涉及安全问题的情况
However, this might not be appropriate for situations in which security is a concern
- 有没有办法在不更改 Apache 配置的情况下做到这一点?可能，我无法触摸托管站点的 Apache conf，并且总是存在安全问题.这样做的正确方法是什么?
推荐答案
为了让 CORS 为您的网站工作(例如 http://example.com)，您必须通过在此处创建 GitHub OAuth 应用程序来启用它:https://github.com/settings/applications
In order to get CORS working for your site (e.g. http://example.com), you have to enable it by creating a GitHub OAuth application here: https://github.com/settings/applications
由于您使用 GitHub 应用程序来使 CORS 工作(不使用它来启用 OAuth 本身)，您只需在创建申请表"的所有三个字段中输入您网站的 URL:
Since you are using a GitHub applications to get CORS to work (not using it for enabling OAuth itself), you can just enter your site's URL in all three fields in the "Create Application form":
请注意，如果您打算使用 OAuth 功能，则需要以不同的方式设置回调 URL.
Note that if you intend to use OAuth functionality, you need to setup Callback URL differently.
在此之后，您应该能够从您的站点 http://example.com 向 GitHub API 发送 AJAX 请求.
After this, you should be able to send AJAX requests to GitHub APIs from your site http://example.com.
这篇关于Github API 和 Access-Control-Allow-Origin的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
