CORS header for OAuth 2.0

[dominikus]

Hi,

I'm a big fan of the OAuth 2.0 beta and it's working great for me! The only issue I have is that the server doesn't respond with a CORS (Cross-Origin Resource Sharing) header which makes cross-domain calls impossible.

Chrome and Firefox both throw a "No 'Access-Control-Allow-Origin' header is present on the requested resource" error. My current work-around is using a proxy, but the benefit of OAuth 2 should be that everything can be done through the browser directly. 

Any plans on implementing the CORS header?

Thanks,

Dominikus

[JeremiahFitbit]

Hi @dominikus, CORS was enabled on api.fitbit.com. We're investigating why it's not responding properly.

[ibahdanau]

Please PM  to me your app id.

[dominikus]

Thanks for the quick responses! I've just sent the app id to Ivan.

[ibahdanau]

try now.

[dominikus]

Still nothing! Chrome 43 says:

XMLHttpRequest cannot load https://api.fitbit.com/1/user/-/activities/steps/date/today/1y.json? No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://local.interfacery.com:6001' is therefore not allowed access.

[dominikus]

Any news on this @ibahdanau @JeremiahFitbit?

Thanks!

[JeremiahFitbit · Accepted solution]

I have confirmed the issue and documented the bug. It will be fixed, but I don't have an ETA.

[dominikus]

looks like it's working now - thanks for your help!