OpenAtlas

if the baseurl of the website you're requesting (in this case https://thanados.openatlas.eu/) is different from the website making the request ( in this case http://127.0.0.1:5000) a http header of the format

Access-Control-Allow-Origin: http://127.0.0.1:5000

needs to be present in the requested websites http response. for reference see https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS

for handling CORS in flask there appears to be a separate module https://flask-cors.readthedocs.io/
implementing this may need some considerations regarding the security of our ajax endpoints though.

for your development environment an adaption to openatlas/views/api.py on your (server side) thanados version setting the header manually may suffice:
https://github.com/craws/OpenAtlas/tree/feature_cors_quickfix

it's untested, but works locally :)
good luck and have a nice evening

Many thanks! I will use this in my local environment. :-)

Still this raises the question (at least for me - please correct me if I am wrong) about the accessibility of the API in general. Wasn't the main purpose that external web applications can get the data from our API? If javascript is used for that (maybe also other approaches) this is not possible without our side to allow for any origin of the request?

Thanks again and all the best,
Stefan

Stefan Eichert wrote:

Many thanks! I will use this in my local environment. :-)

Still this raises the question (at least for me - please correct me if I am wrong) about the accessibility of the API in general. Wasn't the main purpose that external web applications can get the data from our API? If javascript is used for that (maybe also other approaches) this is not possible without our side to allow for any origin of the request?

Thanks again and all the best,
Stefan

You are absolutly correct, every domain should be able to access the API. I have to/will implement this.