7

I'm trying to build an html file to monitor some things on a remote site- specifically, github.com. I'd like to be able to keep it to just that flat file, making the requests straight from the JS to github's API. My thought process went like this:

  1. Let's use jsonp, since I only need read access, so sticking with GETs should be fine.
  2. Ok, I'll use Github's OAuth instead of basic authentication!
    • That fails because the browser doesn't like me redirecting to a local resource: Not allowed to load local resource: file:///Users/... for understandable security reasons.
  3. Ok, I'll load Github's oauth in an iFrame, then get the resulting url (which should contain the oauth code I need).
    • That fails because you apparently can't access anything about a child iframe if it's on another domain, so unless I redirect back to file:///whatever, I can't get the final url. And, of course, I can't redirect to file:///whatever because of the ``Not allowed to load local resource` again.
  4. Ok, I'll use Cross-Origin Resource Sharing (going back to basic auth again)!

So, any suggestions as to how to successfully authenticate to this api from a single, local html file- either as a way around the above tacts, or another idea entirely?

Community
  • 1
  • 1
Fishtoaster
  • 1,809
  • 2
  • 20
  • 36

1 Answers1

1

If you are using google chrome you could try running it with the

--allow-file-access-from-files

switch enabled.

Esailija
  • 138,174
  • 23
  • 272
  • 326
  • 1
    I don't think that'll help - AFAIK all it does is allow AJAX loading of `file:///` if the origin was also within `file:///`. – Alnitak Nov 19 '11 at 05:54
  • @Alnitak, is running a web server on your computer an option? That's the only other thing I've got left :( – Esailija Nov 19 '11 at 06:20
  • 1
    Yeah, running a web server is the last option, after checking stack overflow. :) Related to this answer, I think there's also a chrome option for just allowing cross-origin stuff, although I'd prefer not to have that on when I'm using it for normal stuff. – Fishtoaster Nov 20 '11 at 02:37