650199 - Allow cross-domain XHR requests on the self-serve API for pages that do 302 redirects in response

Status: RESOLVED WONTFIX

(Release Engineering :: General, defect, P2)

Description

[Cameron McCormack (:heycam)]

+++ This bug was initially created as a clone of Bug #649922 +++

With bug 649922 resolved, simple cross-origin GETs to the self-serve build API work.

However, after doing a POST to request a rebuild (to https://build.mozilla.org/buildapi/self-serve/try/build), the server responds with a 302 redirecting to the job information page (http://build.mozilla.org/buildapi/self-serve/jobs/nnnn).  The redirection page also needs to have the CORS headers set, per bug 649922, but currently it doesn't.

This might also be the case with other resources that you can PUT, POST and DELETE to, but I haven't checked.

Comment 1

[Cameron McCormack (:heycam)]

Just checked that POSTing (in lieu of a DELETE) to do a build cancellation also sends a 302 in response with no CORS headers.

Comment 2

[Cameron McCormack (:heycam)]

I was setting format=json in the POST request body, but this was giving me HTML result pages (including the redirect in between).  Now that I'm correctly sending `Accept: application/json`, there is no redirect, so the lack of CORS headers on the redirect page is not impacting me any more.