Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>Try it:</p> <p><code>curl -H "Origin: http://domain.com" -X OPTIONS --head https://www.google.com/</code></p> <p>This currently gives you:</p> <pre><code>HTTP/1.1 405 Method Not Allowed Content-Type: text/html; charset=UTF-8 Content-Length: 962 Date: Fri, 21 Jun 2013 17:58:45 GMT Server: GFE/2.0 </code></pre> <p>So no, you can't, at least not with their public facing website. There would be an <code>Access-Control-Allow-Origin: *</code> in there if that was the case, with a 200 OK. The <code>*</code> is a wildcard for "any domain". So it would either have to be this, or it would have to match your origin.</p> <p>Even if it did return the correct header, you have to have CORS support in the browser. You can see <a href="http://caniuse.com/cors" rel="nofollow">browser compatibility here</a>. IE 8 and 9 only supports CORS through <code>XDomainRequest</code>, which has <a href="http://blogs.msdn.com/b/ieinternals/archive/2010/05/13/xdomainrequest-restrictions-limitations-and-workarounds.aspx" rel="nofollow">heavy restrictions</a> (no cookies, or custom headers, for example). You can read more about <a href="https://developer.mozilla.org/en-US/docs/HTTP/Access_control_CORS" rel="nofollow">access control headers here</a>.</p> <p>When CORS fails, <a href="https://developer.mozilla.org/en-US/docs/Web/JavaScript/Same_origin_policy_for_JavaScript" rel="nofollow">same origin policy</a> is used.</p> <p>There is a way though. The <a href="https://developers.google.com/custom-search/v1/using_rest" rel="nofollow">Google REST API</a> does support cross origin requests:</p> <p><code>curl -H "Origin: http://domain.com" -X GET --head "https://www.googleapis.com/customsearch/v1?"</code></p> <p>Which gives you:</p> <pre><code>HTTP/1.1 400 Bad Request Access-Control-Allow-Origin: http://domain.com Content-Type: application/json; charset=UTF-8 Access-Control-Expose-Headers: Content-Encoding,Content-Length,Content-Type,Server Date: Fri, 21 Jun 2013 18:12:51 GMT Expires: Fri, 21 Jun 2013 18:12:51 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Transfer-Encoding: chunked </code></pre> <p>Notice the <code>Access-Control-Allow-Origin: http://domain.com</code>.</p> <p>So assuming you have an API key, you can, if you use the API.</p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload