I am making an app for shopify, that would allow costumers to send a message to a sites owner.
For this i have made a little server that would send the email on a post request.
Naturally, shopify would not let me do this. Instead, I am getting a cors, cross origin request issue. So I have created a private app, but they don't appear to provide me with the ability to make a post request to my server.
So I am looking into making a public unlisted app. But I am a bit burned out from my last attempt and am not in the mood to go off implementing oauth (for the first time) just to find out that I am still not getting the functionality that I need.
Can anyone please tell me what are the minimum requirements for me to be able to whitelist my server for ajax requests from the client side?.
Related
I am currently trying to build a go API using gin for a web and mobile application. I am new to the world of WebSockets and Go so I was wondering how I would go about triggering a GET request from the client after a relevant POST request was made ie: the POST request contained the user's ID so the clients who require information regarding that user are properly updated. Currently, I have the POST and GET requests which do what I need them, but I'm a little lost about how to make the entire flow realtime using WebSockets.
I believe this example of server-sent-events should address the question. Once a POST handler has been called, send a flag to the GET endpoint via a channel and then send an event through there.
I work at an analytics vendor and we're looking into supporting AMP. I'm looking into beaconing data using amp-analytics. I've got the default trackPageView working from the example in the docs. I get a POST request sent to my server when the page is loaded.
However, one of our use cases is sending a beacon after an AJAX request has completed on the page. The idea is that our customer performs an AJAX request to one of our APIs and gets back some data. Some of that data is used to add elements to the DOM and some of that data is sent back to us which acts as a beacon type in our system. One thing I thought of was since that second piece of data is coming from us and then being sent back to us, we could just send it between our services internally and not have the browser need to send it to us at all, but there are a few issues that prevent us from doing this:
The API in question is high traffic and has caching implemented. There are many more requests being made by browsers than being received by our API's server, and we want to track them all.
We also want to track data such as browser user agent, so we need that request to be sent by the browser, not our API server.
I have a few challenges here with implementing this in AMP:
The AJAX request would be performed by an amp-script element that our customer would put together. Since amp-scripts are very sandboxed, would this cause issues having the contents of an amp-script interact with the AMP runtime?
I don't see any triggers in AMP docs that I could use to have the amp-analytics request sent when the AJAX request completes.
Usually the questions I put together on StackOverflow are more direct, but I'm mostly confused right now on how to implement this with AMP or whether it's even possible to implement it with AMP at all.
I am trying to hit USPS address validation API by AJAX call and I am getting 'Cross-Origin Request Blocked' error.
However when I am trying to access the same address though URL, I am getting the results.
Has this error something to do with approval thing?
The id I am using for this has been approved and I am able to get the result by the API through URL.
I want to access it though scripting. Please help.
Any help would be appreciated.
Thanks in advance.
I think the way you might want to do this is to have the Ajax requests go to your web server -- the same HTTP server where the page came from. And then your server-side program (in PHP, or Python or whatever you're using) relays the request to the USPS server.
Making the request browser-side, from Ajax directly to the USPS server, is just the kind of suspicious activity (called Cross-Site Scripting) that browsers are learning to block.
CORS could theoretically be one way to unblock a Cross-Origin Request, but in that scheme it would be the USPS API server that ultimately grants that permission for pages from your domain. Tech detail: by inserting an Access-Control-Allow-Origin header in response to a request with an Origin header in the Ajax back-and-forth.
I'm building a small web app with Ember.js and Firebase so as of now I don't have a framework. I'm trying to use Venmo's OAuth and API to get usernames, emails, and friends. I got OAuth to work and I get a client-side access token to use in an API call, but whenever I try and send a GET to https://api.venmo.com/v1/me?access_token=<access_token> using AJAX or CORS I get an error saying XMLHttpRequest cannot load https://api.venmo.com/v1/me?access_token=<access_token>. No 'Access-Control-Allow-Origin' header is present on the requested resource. Is there a way to do this with javascript
I'm an API engineer over # Venmo, and we're looking to open up CORS support very soon, in the next couple months hopefully. Feel free to email developer#venmo.com and bug us if you need to :P
I am currently using Django 1.2. I am trying to send an ajax request to my Django site from our newly established drupal installation. I am able to send the request no problem from one view to another on my DJANGO site but I am unable to send a request from my local machine. I continue to get an error, I assume there is a CSRF verification issue. Does anyone know how I may resolve this issue.
-Greg
Not so recommended but quickest:
You can easily disable csrf protection for certain django views using csrf_exempt decorator. You can find more info in django docs
this might be also more justified if you run your app in 'trusted environment'.
Please mind that this causes some security problems. If you decide to use csrf_exempt you can think of some additional verifications (eg. you can allow requests on some view for some limited set of IPs or something else).