Github API 和 Access-Control-Allow-Origin

2022-01-15 00:00:00 cors github github-api ajax

这可能是一个简单的(一系列)问题，但我无法理解它.

this probably is a simple (series of) question(s) but I can't wrap my head around it.

我正在尝试从我网站上托管的网络应用程序访问 github api.简而言之，这是代码:

I'm trying to access the github api from a web app hosted on my site. This is the code in a nutshell:

<!DOCTYPE html>
<html>
<head>
  <style>p { color:red; }</style>
  <script src="http://code.jquery.com/jquery-latest.js"></script>
  <script>
  $(document).ready(function () {

$.ajax( {url :'https://api.github.com/repos/janesconference/kievIIPlugins/commits', dataType: "json", cache: false, success: function (data, textStatus, jqXHR)
        {
            var lastCommitSha = data[0].sha;
            $("p").text("Last commit SHA: " + lastCommitSha);
        }
    });
});
  </script>

</head>
<body>
  <p>Ajax request not (yet) executed.</p>

</body>
</html>

如果我将浏览器指向在我的 Dropbox 帐户上上传的这个简单页面一切都好.相反，如果我将浏览器指向 在我的网站上 上传的这个简单页面，我会得到臭名昭著的 Access-Control-Allow-Origin 异常:

If I point my browser to this simple page uploaded on my dropbox account everything is ok. If, instead, I point my browser to this simple page uploaded on my site, I get the infamous Access-Control-Allow-Origin exception:

XMLHttpRequest cannot load https://api.github.com/repos/janesconference/kievIIPlugins/commits?_=1360060011783. Origin http://bitterspring.net is not allowed by Access-Control-Allow-Origin.

所以，问题:

  • 为什么它可以在 Dropbox 上运行?
  • 我了解使用 CORS 甚至可以在网站上使用.这是将 Access-Control-Allow-Origin: *.github.com 放在我的 Apache 配置或类似的东西上的问题.但是，正如 en.wiki 所引用的，
  • Why does it work on Dropbox?
  • I understand that with CORS it would work even on the website. This is a matter of putting Access-Control-Allow-Origin: *.github.com on my Apache configuration or something like that. But, as quoted from en.wiki,

但是，这可能不适合涉及安全问题的情况

However, this might not be appropriate for situations in which security is a concern

  • 有没有办法在不更改 Apache 配置的情况下做到这一点?可能，我无法触摸托管站点的 Apache conf，并且总是存在安全问题.这样做的正确方法是什么?

    • 推荐答案

    为了让 CORS 为您的网站工作(例如 http://example.com)，您必须通过在此处创建 GitHub OAuth 应用程序来启用它:https://github.com/settings/applications

    In order to get CORS working for your site (e.g. http://example.com), you have to enable it by creating a GitHub OAuth application here: https://github.com/settings/applications

    由于您使用 GitHub 应用程序来使 CORS 工作(不使用它来启用 OAuth 本身)，您只需在创建申请表"的所有三个字段中输入您网站的 URL:

    Since you are using a GitHub applications to get CORS to work (not using it for enabling OAuth itself), you can just enter your site's URL in all three fields in the "Create Application form":

    • 名称:http://example.com
    • 网址:http://example.com
    • 回调网址:http://example.com

    请注意，如果您打算使用 OAuth 功能，则需要以不同的方式设置回调 URL.

    Note that if you intend to use OAuth functionality, you need to setup Callback URL differently.

    在此之后，您应该能够从您的站点 http://example.com 向 GitHub API 发送 AJAX 请求.

    After this, you should be able to send AJAX requests to GitHub APIs from your site http://example.com.

相关文章