[OSM-dev] cross-domain xmlhttprequest

[Stephan Plepelits]

Hi Folks!

I just ran into a problem ... I'd like to access OpenStreetMap data
directly from a web application via a XMLHttpRequest. Unfortunately
cross-domain XMLHttpRequests are not allowed unless the foreign web server
replies with a special HTTP-header (Access-Control-Allow-Origin) and you
are using a modern browser (e.g. Firefox >=3).

Here you can find some documentation:
http://www.w3.org/TR/access-control/

This is the needed HTTP-header-line:
Access-Control-Allow-Origin: *
(this would allow XMLHttpRequests from any client web browser)

Does anybody see a problem adding these HTTP-Header-line to the
OpenStreetMap-API and the Nominatim-API?

greetings,
Stephan
--
Seid unbequem, seid Sand, nicht ?l im Getriebe der Welt! - G?nther Eich
,---------------------------------------------------------------------.
| Stephan Plepelits, |
| Technische Universit?t Wien - Studien Informatik & Raumplanung |
| Projects: |
| > openstreetbrowser.org > couchsurfing.org > tubasis.at > bl.mud.at |
| Contact: |
| > Mail: skunk at xover.mud.at > Blog: plepe.at > Jabber: skunk at fsinf.at|
| > Twitter: twitter.com/plepe > Wave: plepelits at googlewave.com |
`---------------------------------------------------------------------'

[John Smith]

Post by Stephan Plepelits
Does anybody see a problem adding these HTTP-Header-line to the
OpenStreetMap-API and the Nominatim-API?

If you don't want to wait for others to update their scripts you could
proxy the request via a php script... This would have the side benefit
of working for older browsers too...

[Peter Körner]

Post by John Smith

Post by Stephan Plepelits
Does anybody see a problem adding these HTTP-Header-line to the
OpenStreetMap-API and the Nominatim-API?

If you don't want to wait for others to update their scripts you could
proxy the request via a php script... This would have the side benefit
of working for older browsers too...

That's the way i'll do it: read the xml with php, preprocess it,
dropping all data you don't need, cache when appropriate and return as json.

It would be cool to have suche a proxy for the complete osm api..

Peter

[John Smith]

Post by Peter Körner

Post by John Smith

Post by Stephan Plepelits
Does anybody see a problem adding these HTTP-Header-line to the
OpenStreetMap-API and the Nominatim-API?

If you don't want to wait for others to update their scripts you could
proxy the request via a php script... This would have the side benefit
of working for older browsers too...

That's the way i'll do it: read the xml with php, preprocess it,
dropping all data you don't need, cache when appropriate and return as json.
It would be cool to have suche a proxy for the complete osm api..

Just make a 1:1 proxy script then it will be a complete osm api ;)

[Peter Körner]

Post by John Smith
Just make a 1:1 proxy script then it will be a complete osm api ;)

But where's the fun then? (;

Peter

[Tom Hughes]

Post by Stephan Plepelits
I just ran into a problem ... I'd like to access OpenStreetMap data
directly from a web application via a XMLHttpRequest. Unfortunately
cross-domain XMLHttpRequests are not allowed unless the foreign web server
replies with a special HTTP-header (Access-Control-Allow-Origin) and you
are using a modern browser (e.g. Firefox>=3).
http://www.w3.org/TR/access-control/
Access-Control-Allow-Origin: *
(this would allow XMLHttpRequests from any client web browser)

My understanding was that the XHR cross domain stuff had been abandoned?
is that spec still valid and likely to be widely implemented? or is it a
dead end?

Tom

[andrzej zaborowski]

Hi Stephan,

Post by Stephan Plepelits
I just ran into a problem ... I'd like to access OpenStreetMap data
directly from a web application via a XMLHttpRequest. Unfortunately
cross-domain XMLHttpRequests are not allowed unless the foreign web server
replies with a special HTTP-header (Access-Control-Allow-Origin) and you
are using a modern browser (e.g. Firefox >=3).

Wikipedia API and others support JSON-P, this lets you load query
results (only GET requests) through simple <script source="..." /> and
works cross-domain. It would require that we support returning JSON
instead of XML and adding the "callback" parameter to calls, but
receiving JSON would be an additional gain for any javascript code
using the API. I'd find that very useful, either on the main api or a
separate service that syncs through planet diffs.

Cheers