So over the course of doing FCC I’ve had to use a lot of web APIs and one thing I have noticed is that almost every single one of them has a fairly major problem that makes their usage a complete pain. What I mean is, either the site will not support HTTPS, it won’t support CORS, it won’t support J…

I mean you could argue that even the fundamental architecture of web “APIs” is broken/flawed thanks to CORS because it is pretty much meant to prevent code on one website from requesting code from another website. Isn’t JSONP a hack to get around this fact?

Depends how you look at it really, some would say that querying an api should be left to the back-end of an application and then the data should be pushed/pulled to the front-end therefore cors would never be an issue

Lots of servers (or maybe I’ve just been unlucky) seem not to do this, though. It’s completely baffling to me that somebody would take the time to make a public web API and not do this.

According to https://www.quora.com/Why-doesnt-Twitters-API-support-CORS This is deliberately done to discourage browser-only clients, even with OAuth-whatever, to reduce chances of having client (or consumer) secrets being stolen.

[image] drguildo: What I mean is, either the site will not support HTTPS, it won’t support CORS, it won’t support JSONP etc. or a combination of all of those things. Seeing as those things are pretty much essential to use the API without implementing a bunch of hacks and workarounds I was wonder…

forismatic.com and OpenWeatherMap

I find that public APIs are usually fine, but can be really poorly documented. It’s not that they don’t work, just that they often forget to tell you the weird secret handshake you need to get it to work :slight_smile:

The problem with both of those is simply that they aren’t hosted securely. It’s not that the API is poorly designed, it’s just that security policies in the most popular browsers are changing and these services are left behind. To your question, their rational (not mine) for not allowing a SSL con…

Why are many web APIs so bad?

BenGitter December 2, 2016, 1:07pm 4

The default “setting” does indeed prevent cross origin requests, but the API can also easily set its server to accept cross origin requests.

Topic		Replies	Views
Trouble handling APIs	2	690	June 16, 2017
If we can't make cross origin requests without JSONP, how are we doing it with other websites like Google maps without JSONP?	2	1195	January 17, 2018
A few questions about bypassing the same origin policy	4	1436	March 17, 2017
For those of you who are stuck on the Weather API Projects api , apis , jquery , json , darkskiapi	5	6418	July 13, 2017
Calling OpenWeatherMap API is blocked due to CORS header ‘Access-Control-Allow-Origin’ missing	7	20387	November 28, 2019

Why are many web APIs so bad?

Related topics