CORS support about chef-server HOT 3 OPEN

CORS would be nice, but what would you pass along with these requests in terms of auth creds? This seems like something maybe oc-id might be better suited for.

from chef-server.

From discussion of this amongst Team VI:

Without CORS support you can never build a single page javascript app that talks directly to the server. A proxy will always be needed, but needing a proxy is silly, b/c the server already talks http.

Nathan points out that:

With chef-zero right now, I can pop in a console and do jQuery.get("http://localhost:8889/nodes").then(function (nodes) { console.log("woot nodes!", nodes); });
I get a same origin error if I try that against a real chef server

from chef-server.

Further discussion, from Nathan Smith, in response to Chris' question about auth creds:

You would need token auth (https://github.com/chef/chef-rfc/blob/master/rfc038-token-authentication.md) to make it useful at all, but token auth would be useless for a browser-based app without CORS.

oc-id could be the token provider or maybe not.

from chef-server.