CUNY Academic Commons

He replies "
Zweibel, Stephen
May 17, 2023, 4:09 PM EDT
Hi,
Thanks for responding. It’s just me using JavaScript on an HTML file, so an AJAX call. We use GitHub Pages for our static site in order to not have to pay for a server. And the feed is:
https://gclibrary.commons.gc.cuny.edu/category/blog/website-front-page/feed/?fsk=5c1146bca3512
Something like this: https://levelup.gitconnected.com/javascript-basics-how-to-use-rss-to-retrieve-medium-articles-d9c4d7c10387
Or this: https://css-tricks.com/how-to-fetch-and-parse-rss-feeds-in-javascript/
Steve

We use GitHub Pages for our static site in order to not have to pay for a server.

Do you have the application built already, and hosted on GitHub Pages? I can certainly write my own small application to mimic what you're doing, but it would be easier if I could use yours.

Sure, the Pages site is: https://gc-library.github.io/Mina-Rees-library-site/
and the repo is: https://github.com/GC-Library/Mina-Rees-library-site
you can see the code in static/js/utils.js and the error can be seen in the console: Access to fetch at 'https://gclibrary.commons.gc.cuny.edu/category/blog/website-front-page/feed/?fsk=5c1146bca3512' from origin 'https://gc-library.github.io' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
And actually I tried this 'no-cors' mode and it didn't work.
Thanks,
Steve
Stephen Zweibel
Digital Scholarship Librarian
CUNY Graduate Center
________________________
From: Marilyn Weber (CUNY Academic Commons) <support@cunycommons.zendesk.com>
Sent: Thursday, May 18, 2023 12:50 PM
To: Stephen Zweibel <szweibel@gc.cuny.edu>
Subject: [CUNY Academic Commons] Re: Commons CORS Error

Thanks for providing this information. Rather than the wildcard header you suggested, I've introduced a specific exception for https://gc-library.github.io. For my reference, see the following in our root htaccess:

 41 Header set Access-Control-Allow-Origin 'https://gc-library.github.io'
 42 Header set Access-Control-Allow-Headers "Origin, X-Requested-With, Content-Type,     Accept, User-Agent"  

In my tests, the RSS importer at https://gc-library.github.io/Mina-Rees-library-site/ is now fetching items and logging them in the console.

Stephen Zweibel replies

I appreciate that, and the whitelisting makes sense. Could you also whitelist http://library.gc.cuny.edu/ ? Stephen Klein has a server that we're using at the moment. Thanks.
This approach does make testing the RSS on my own pc impossible, I think, so that is a downside. or I can use one of those (very sketchy) CORS-ignoring extensions like this one: https://chrome.google.com/webstore/detail/allow-cors-access-control/lhobafahddgcelffkeicbaginigeejlf

Steve Z confirms that this work. I think this ticket can be closed now.