I have a client that want to display data from their API in a text ticker.
I need to send a GET request with some custom header data for authentication, which is simple enough. My problem comes when the HTML producer blocks my request due the the CORS policy not allowing cross-origin requests. Has anybody done something like this? I really don’t want to set up a server just for this small ticker. Is it possible to do this withing the script of the HTML template?
Appreciate all help I can get. The deadline is approaching fast and I need to get this done.
Hey @Byberg.
I am guessing you are loading the template on localhost correct? You can try adding the Access-Control-Allow-Origin meta tag and placing the domain as the value. Here is the MDN page for more info.
A bit more complicated, you could also setup a reverse proxy. But, that involves knowing some sort of web server framework.
As far I understand it the Access-Control-Allow-Origin: * tag needs to be on the server side. In my case that would be my clients API which I don’t have access to for obvious reasons.
I’ll take a look at setting up a revers proxy. I think I need to give up on the idea of doing it all withing the template. Thanks for the tip.
No, that is almost never the case and it’s potentially a security risk. CORS is a client sided defense mechanism against a malicious HTML page making an HTTP request to another service using the identity of the user. (e.g. a script on google.com asking facebook.com to read private messages). This is a defense built into the browser and used to protect the end user. Setting the aforementioned header to “*” will completely disable this mechanism. Instead the specific client should disable the mechanism locally (which is OK in the case of CasparCG as a user is not signed in to any services)