'Access-Control-Allow-Origin: https://src.fedoraproject.org'

Is src.fp.o the unique website that access mdapi on apps.fp.o?

If mdapi's intent is to be a public API this should be * and not src.fp.o, otherwise any modern web browser based query to mdapi will get cors errors.

:thumbsup: for pagure's change, but as said this will need proper header configuration on mdapi side to allow public access to it and it could need changes on src.fp.o's CSP headers configuration on infra's ansible repo (connect-src vs script-src)

'Access-Control-Allow-Origin: https://src.fedoraproject.org'

Is src.fp.o the unique website that access mdapi on apps.fp.o?
If mdapi's intent is to be a public API this should be * and not src.fp.o, otherwise any modern web browser based query to mdapi will get cors errors.

I just wanted to restrict this if possible, but I'm fine with a wildcard, too.

Reading https://api.jquery.com/jQuery.ajax/ I don't think we need this change :)

If mdapi's intent is to be a public API this should be *

+1 to this, mdapi is meant to be a public API, so I'm fine with using * on its CORS header

Reading https://api.jquery.com/jQuery.ajax/ I don't think we need this change :)

Agreed. I'm not sure which documentation suggested this, but removing it doesn't make any difference. Looks to me like it isn't needed here.

I think we can squash the commits, adjust the commit message and get this in.

I'm not sure why the tests are failing though :(

I think the commit message can be improved

I see you've updated the commit message, however, I think it should still be improved.

You may want to read https://chris.beams.io/posts/git-commit/ and check your commit message afterward

Thanks! :)

Let's get this in :)

I guess the change in server was because apps.fp.o is returning the wrong Content-Type? ab tells me that the direct one is 4 times slower than the apps.fp.o one, but in browser it seems to be much much worse, like 2-3 seconds to load.

JSONP expects a javascript script basically, where the JSON is encapsulated in a JS blob and mdapi do not support this. So we've tweak mdapi to return the proper content-type and the correct CORS headers to allow cross-domain querying and we're adjusting pagure here to be able to use plain JSON.

I'm not quite following you on the speed numbers you're giving here though.

For speed, I was using ab like in your introductory blog post. I may have been led astray though as it seems that apps.fp.o is returning a 302 and ab didn't mention that very prominently. (I'm sure that apps.fp.o used to work though, since it's what you used on your blog post, and in some mdapi PRs.)

In any case, looking at a browser console, there is still a case of apps.fp.o being blocked, but this may be because updates are not deployed?

Yes, this code hasn't been deployed yet :)