CORS header missing
The API at address https://api.mojang.com/users/profiles/minecraft/<username> doesn't respond with CORS headers, particularly Access-Control-Allow-Origin: * is missing. Without this header modern browsers will discard the response and create an error message.
In the Developer Tools of Firefox this looks like:
fetch('https://api.mojang.com/users/profiles/minecraft/test').then(console.log)
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://api.mojang.com/users/profiles/minecraft/test. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing).
TypeError: NetworkError when attempting to fetch resource.
To set mode:no-cors is not an option because in this case the browsers exchange the response with an opaque one, which is basically empty.
fetch('https://api.mojang.com/users/profiles/minecraft/test', {mode:'no-cors'}).then(console.log)
Currently the only way to use this API with browsers is to set up an additional server as a proxy that adds this header. But that's not what I want. In times of GDPR I'm not interested to run such a server or to use a third party server for a web application that should only run in the browser. Please consider to add the mentioned header.
Linked Issues
NormalCreated Issue:
MCAPI-2024
CORS header missing
The API at address https://api.mojang.com/users/profiles/minecraft/<username> doesn't respond with CORS headers, particularly Access-Control-Allow-Origin: * is missing. Without this header modern browsers will discard the response and create an error message.
In the Developer Tools of Firefox this looks like:
fetch('https://api.mojang.com/users/profiles/minecraft/test').then(console.log)
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://api.mojang.com/users/profiles/minecraft/test. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing).
TypeError: NetworkError when attempting to fetch resource.
To set mode:no-cors is not an option because in this case the browsers exchange the response with an opaque one, which is basically empty.
fetch('https://api.mojang.com/users/profiles/minecraft/test', {mode:'no-cors'}).then(console.log)
Currently the only way to use this API with browsers is to set up an additional server as a proxy that adds this header. But that's not what I want. In times of GDPR I'm not interested to run such a server or to use a third party server for a web application that should only run in the browser. Please consider to add the mentioned header.
![[Mod] Neko](../../../data/avatars/users/92901.png){kind=small}
MCAPI-2024 → 
WEB-1587
relates to
![[Mod] Greymagic27](../../../data/avatars/users/92875.png){kind=small}
relates to
For the records, more than two month after this ticket was set to "Resolved" the problem still exists.
Why would they mark this as fixed if its still a real issue.