{"action":"closed","issue":{"url":"https://api.github.com/repos/18F/18f.gsa.gov/issues/507","labels_url":"https://api.github.com/repos/18F/18f.gsa.gov/issues/507/labels{/name}","comments_url":"https://api.github.com/repos/18F/18f.gsa.gov/issues/507/comments","events_url":"https://api.github.com/repos/18F/18f.gsa.gov/issues/507/events","html_url":"https://github.com/18F/18f.gsa.gov/issues/507","id":56581005,"number":507,"title":"Add CORS support","user":{"login":"konklone","id":4592,"avatar_url":"https://avatars.githubusercontent.com/u/4592?v=3","gravatar_id":"","url":"https://api.github.com/users/konklone","html_url":"https://github.com/konklone","followers_url":"https://api.github.com/users/konklone/followers","following_url":"https://api.github.com/users/konklone/following{/other_user}","gists_url":"https://api.github.com/users/konklone/gists{/gist_id}","starred_url":"https://api.github.com/users/konklone/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/konklone/subscriptions","organizations_url":"https://api.github.com/users/konklone/orgs","repos_url":"https://api.github.com/users/konklone/repos","events_url":"https://api.github.com/users/konklone/events{/privacy}","received_events_url":"https://api.github.com/users/konklone/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-02-04T20:15:00Z","updated_at":"2015-02-26T15:48:55Z","closed_at":"2015-02-26T15:48:55Z","body":"We have a bunch of little JSON endpoints now, on the main site and the hub (and maybe the dashboard?), and we've identified at least one use case for CORS.\r\n\r\nThis can be tackled centrally in this repo's nginx config, by adding [these lines](https://github.com/konklone/cdns-to-https/blob/gh-pages/nginx/cdn.cors) to the appropriate endpoints:\r\n\r\n```\r\nadd_header Access-Control-Allow-Headers \"X-Requested-With\";\r\nadd_header Access-Control-Allow-Methods \"GET, HEAD, OPTIONS, POST\";\r\nadd_header Access-Control-Allow-Origin \"*\";\r\n```\r\n\r\nI think we want to remove `POST` from the allowed methods here, especially if we want to just apply it to the whole domain and not think hard about which endpoints need what level of protection.\r\n\r\ncc @shawnbot @mbland "}}