Configure google app engine application for cross-

Question

Could you please advise, how we can configure our Python app hosted on Google App Engine to accept the OPTIONS, GET, POST, PUT and DELETE from AJAX being done from browser?

The specifics of such calls are XmlHTTPRequest first does OPTIONS request to the server to see what cross-domain verbs are allowed and if desired one is in the list - browser does this request afterwards.

Right now we just get a 405 Method Not Allowed in attempt of browser to do OPTIONS request.

AJAX calls are being done from another site/domain.

Thank you,

Roman.

Answer 1

One way to bypass the same-origin policy allowing browsers cross-domain requests is adopting JSONP but AFAIK, it only supports the GET verb; In fact, it's a GET request to retrieve the src of a <script> tag injected in the DOM Document

If JSONP is not an option, a more modern way is by using CORS, adding the Access-Control-Allow-Origin Http header to the response ^*:

In Python:

self.response.headers['Access-Control-Allow-Origin'] = '*'

In Java:

resp.setHeader("Access-Control-Allow-Origin", "*");

^{* Check the browser compatibility here}