cors access-control-allow-origin

[Kevin]

I have been writing a javascript site to keep track of books my family reads. As part of this I have been trying to connect to the goodreads api to lookup books. Unfortunately GoodReads does not include the CORS header in ANY of their api calls. This causes the browser to think there is a CrossSite attack happening and not allowing my request to go through. I am hoping that you could open up some of your apis with the CORS headers.

Some of the apis I want to hit directly are,
- https://www.goodreads.com/book/show
- https://www.goodreads.com/book/title
- https://www.goodreads.com/search/inde...

In the meantime I have had to create a proxy server on webtask.io to hit your site indirectly.

[Michael]

Sorry about that Kevin. We'll consider adding this in the future.

[Brett]

+1

Was surprised to run into this issue today. The API is essentially useless for modern web development without the CORS header.

[Chikamichi]

Hi,

Any news on this topic? I second Brett here.

[Thomas]

I would also love to see this implementation! Wonder if any of the programmers over at Goodreads are taking at look at this issue as of late?

[Pablo]

Any news? This would be really useful. I agree with Brett, CORS support is really necessary nowadays.

[Darian B. Johnson]

I had the same problem. I ended up using the Amazon API to get the image information. Note, if you go that route Amazon's images links are NOT CORS, but, you can easily find their CORS images by replacing ''https://images-na.ssl-images-amazon.com' with ''https://images-na.ssl-images-amazon.com'

[Pablo]

Such a shame that this could be solved by adding one header to the response of the server but it is not being considered.

[Kemory]

I can't believe this is still a thing in 2017

[Thomas]

And still!

[Alex]

Nothing new on this? Cors is a big problem, specially if someone use, like me, angular4 to get the api requests. For the request is ok, but the headers in the response are wrong and it's impossible to use API with Angular4.

[Dennis]

still not any cors headers, and no json :(

[Steve]

Interested in whether or not this is request is being seriously considered by Goodreads. Can we expect CORS compliant headers any time in the near future or is this simply a non-starter?

[Val]

Still in 2018 :(

[Jose]

A workaround is to use http://cors-anywhere.herokuapp.com/

use it as: http://cors-anywhere.herokuapp.com/ht...

[Siva]

@Jose I had some issues with your workaround in firefox and chrome, it works in localhost

Here is my findings, hope this helps.

Blocked loading mixed active content “http://cors-anywhere.herokuapp.com/ht...”

Below are the steps that helped me resolve the issue.

1. replaced http:// with https://
Refer:
1. https://markitzeroday.com/x-requested...


Source code for reference:
var config = {headers: {"X-Requested-With" : "XMLHttpRequest"}};
axios.get("https://cors-anywhere.herokuapp.com/h..."+ this.grkey + "&q=" + this.keyword + '&page=' + this.page, config )

[Steve]

Any bets on whether or not 2019 will bring about the addition of the access-control-allow-origin header?

[Christian]

Steve wrote: "Any bets on whether or not 2019 will bring about the addition of the access-control-allow-origin header?"

Since this has been asked for since 2016, and adding CORS headers takes 5minutes and it has not been done yet... I wouldn't bet a penny on this. I'll try the proxy solutions above...

[Kemory]

This still an issue in 2019!

It is becoming painfully obvious to me that since the purchase by Amazon, Goodreads is only meant to serve as a tool only for Amazon and not anyone else.

This API was never meant to be public.

[Thong]

Still hasn't fixed in 2019

[Erik]

Just started using this API. Why hasn't this been fixed yet?

[Kemory]

Erik wrote: "Just started using this API. Why hasn't this been fixed yet?"

Because they need the API to be as limited as possible while giving the impression that it is giving the public access to data it has helped created.

[Joeffison]

Also facing the same issue.

[Carlos]

+1

[Catie]

Also facing this issue

[Jacopo]

+1

[Rick]

Are you all developing in a way that you cannot make the API calls from the server side? If you make the calls server side, then there is no problem with the CORS. This is only a problem for client side calls. Calling from client side is not ideal, especially if you are using OAUTH.

[Gabriel]

+1 - I encountered the same issue with an Angular app.

[Vishwesh]

Still not solved in 2020. Using shopify and thus have to use Ajax. I used a proxy instead - https://cors-anywhere.herokuapp.com/

Hope this helps.

[Ben]

I'm also using https://cors-anywhere.herokuapp.com/ on my app. Just tried hitting the API without it, still getting the CORS error.