This looks like it might have been requested before:

Support Cross-Origin Resource Sharing

In order for CORS to work, the Access-Control-Allow-Origin header (and related headers) must be set. With CORS support, I can have client-side javascript that accesses the API methods directly, rather than proxying the data through my own server or injecting "script" tags with JSONP. The result is less load for me, less risk of injection issues, and less needless copying of data around.

CORS is supported in all browsers but Opera. Firefox and Chrome have had support for quite some time now.


HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Fri, 20 Jan 2012 02:06:16 GMT
Content-Type: application/json; charset=utf-8
Connection: keep-alive
Cache-Control: private
Content-Encoding: gzip
X-AspNetMvc-Version: 3.0
X-AspNet-Version: 4.0.30319
Content-Length: 4828

Contrast that with the Glitch API:


Access-Control-Allow-Methods:POST, GET, OPTIONS
Content-Type:text/plain; charset=utf-8
Date:Fri, 20 Jan 2012 02:07:15 GMT

Access-Control-Allow-Origin is the important header here - it tells AJAX-enabled browsers whether or not they are allowed to access the content returned in the message.

Since this header effectively limits only AJAX-based API requests, the only security or performance issues would be related to whether or not it was "okay" for browsers to access the API methods directly via AJAX.

  • 1
    Not that it invalidates this request in any way, but note that the API does support JSONP.
    – Tim Stone
    Commented Jan 20, 2012 at 2:36
  • @TimStone, that's my backup plan, should this be deferred.
    – agent86
    Commented Jan 20, 2012 at 4:06
  • This has started happening intermittently again just now. Could it be related to moving facilities or testing failover like I heard about on a recent podcast? Commented Oct 30, 2012 at 10:24
  • 1
    @hippietrail, I've noticed issues in other areas, so I'm assuming the migration has a few hiccups. If it persists, you might ask a new question to file a bug with the team - I got pinged for your comment, and I can't do anything, I'm just a guy who codes against their API for entertainment :(
    – agent86
    Commented Oct 30, 2012 at 13:58
  • Thanks @agent86 - I'll keep an eye out and will file a new bug report if it doesn't just go away. Commented Oct 30, 2012 at 14:01

1 Answer 1


The API now responds with the following headers:

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Fri, 20 Jan 2012 18:53:44 GMT
Content-Type: application/json; charset=utf-8
Connection: keep-alive
Cache-Control: private
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST
Access-Control-Allow-Credentials: false
Content-Length: 12345

Since we don't current serve anything that requires preflighting* requests, I think this is sufficient.

*Hitting any route with an OPTIONS request results in undefined behavior, currently.

  • 3
    Awesome. If I had cookies and a way to give them to you, I'd totally give you some.
    – agent86
    Commented Jan 20, 2012 at 18:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .