CORS for oEmbed

[cpwinn]

When calling the oEmbed provider from JavaScript in a browser there are no CORS headers in the response. This obviously causes the browser to block the request. Any chance we can get a response header like the following?

Access-Control-Allow-Origin: "*"

This happens with all oEmbed requests but here is an example url:

https://giphy.com/services/oembed?url=https%3A%2F%2Fgiphy.com%2Fgifs%2Fcant-hardly-wait-kW8mnYSNkUYKc

and the full requst:

var xhr = new XMLHttpRequest();
xhr.onreadystatechange = function() {
  if (xhr.readyState === 4) {
    console.log(xhr.response);
  }
}
xhr.open('GET', 'https://giphy.com/services/oembed?url=https%3A%2F%2Fgiphy.com%2Fgifs%2Fcant-hardly-wait-kW8mnYSNkUYKc');
xhr.send();

[l0c0luke]

I ran into this with a PHP library I have been using for years to get the oembed... now it returns the image saying "are you a robot?"

oscarotero/Embed#185 (comment)

[shwetaatgiphy]

Hey @cpwinn

We we made changes to CORS header management fairly recently. Please give this a try again and feel free to open the issue if needed.
Hopefully those fixes help.

Thanks.

[cpwinn]

@shwetaatgiphy Looks like this issue is unchanged. You can run the code snippet above in a browser console to reproduce it.

[shwetaatgiphy]

Gottit, thanks for taking a look @cpwinn!
I'll forward this to the relevant team now & reach out with any updates they may have

[cbieser]

@shwetaatgiphy do you have any updates on this issue?