This allows your dataview frontend to access the data API from the browser. The data is already publicly available, so this doesn’t introduce any security risk - it simply lets the browser load the same data your servers already serve
Right now, the viewer at https://dataview.raspberryshake.org is blocked by the browser because the API doesn’t send an Access-Control-Allow-Origin header.
Adding that header will resolve the CORS errors seen in embedded viewers (QtWebEngine, Chrome, etc).
a couple of questions before we make any changes to the API configuration.
the absence of an Access-Control-Allow-Origin header is only one possible cause of a browser-side CORS failure. Could you provide:
the value of the request’s Origin header (visible in the browser’s Network tab).
whether the JavaScript making the request is running from https://dataview.raspberryshake.org itself, or from another origin (for example, quakehub.online).
would authorize only JavaScript executing from that origin. it would not enable requests originating from other sites.
also, is the official DataView application itself currently unable to retrieve data from data.raspberryshake.org, or is this only occurring when DataView is embedded within QuakeHub? If the official application works as expected, I’d like to understand what differs in your setup before changing the API’s CORS policy.
once we have the above information we can determine whether a targeted CORS change is appropriate, or whether the issue lies elsewhere.