Access-Control-Allow-Origin in Django app

Question

I'm developing a Phonegap app for my Django based app, but when trying to make Ajax calls I get this error:

XMLHttpRequest cannot load http://domain.herokuapp.com/getcsrf/?tags=jquery%2Cjavascript&tagmode=any&format=json. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'null' is therefore not allowed access.  

How can I make it so my Django app allows cross origin for some urls?

Here's my Ajax code:

get: function() {     $.getJSON("http://domain.herokuapp.com/getcsrf/",     {         tags: "jquery,javascript",         tagmode: "any",         format: "json"     },     function(data) {         $.each(data.items, function(item){             console.log(item);             });     }); } 

Answer 1

Django by default does not provide the headers necessary to provide cross origin. The easiest way would be to just use this Django app that handles it for you: https://github.com/adamchainz/django-cors-headers

• Add to installed apps
• Add to middleware
• Then stuff like...

CORS_ALLOWED_ORIGINS = [     "http://read.only.com",     "http://change.allowed.com", ] 

to support allowing all, just use the setting... CORS_ALLOW_ALL_ORIGINS = True and then do any filtering of the request in middleware or in the view.

Answer 2

For single views you can manually add headers:

@require_GET def api_getto(request):     response = JsonResponse(         # your stuff here     )     response["Access-Control-Allow-Origin"] = "*"     response["Access-Control-Allow-Methods"] = "GET, OPTIONS"     response["Access-Control-Max-Age"] = "1000"     response["Access-Control-Allow-Headers"] = "X-Requested-With, Content-Type"     return response