@@ -16,6 +16,7 @@ you have any problems or requests please contact
1616* <a href =" #authentication " >Authentication</a >
1717* <a href =" #pagination " >Pagination</a >
1818* <a href =" #rate-limiting " >Rate Limiting</a >
19+ * <a href =" #cross-origin-resource-sharing " >Cross Origin Resource Sharing</a >
1920* <a href =" #json-p-callbacks " >JSON-P Callbacks</a >
2021
2122##Schema
@@ -201,6 +202,39 @@ You can file a [support issue](http://support.github.com/dashboard/queues/2386-a
201202to request white listed access for your application. We prefer sites that
202203setup OAuth applications for their users.
203204
205+ ##Cross Origin Resource Sharing
206+
207+ The API supports Cross Origin Resource Sharing (CORS) for AJAX requests.
208+ you can read the[ CORS W3C working draft] ( http://www.w3.org/TR/cors ) , or
209+ [ this intro] ( http://code.google.com/p/html5security/wiki/CrossOriginRequestSecurity ) from the
210+ HTML 5 Security Guide.
211+
212+ Here's a sample request sent from a browser hitting
213+ ` http://some-site.com ` :
214+
215+ $ curl -i https://api.github.com -H "Origin: http://some-site.com"
216+ HTTP/1.1 302 Found
217+
218+ Any domain that is registered as an OAuth Application is accepted.
219+ Here's a sample request for a browser hitting[ Calendar About Nothing] ( http://calendaraboutnothing.com/ ) :
220+
221+ $ curl -i https://api.github.com -H "Origin: http://calendaraboutnothing.com"
222+ HTTP/1.1 302 Found
223+ Access-Control-Allow-Origin: http://calendaraboutnothing.com
224+ Access-Control-Expose-Headers: Link, X-RateLimit-Limit, X-RateLimit-Remaining, X-OAuth-Scopes, X-Accepted-OAuth-Scopes
225+ Access-Control-Allow-Credentials: true
226+
227+ This is what the CORS preflight request looks like:
228+
229+ $ curl -i https://api.github.com -H "Origin: http://calendaraboutnothing.com" -X OPTIONS
230+ HTTP/1.1 204 No Content
231+ Access-Control-Allow-Origin: http://calendaraboutnothing.com
232+ Access-Control-Allow-Headers: Authorization, X-Requested-With
233+ Access-Control-Allow-Methods: GET, POST, PATCH, PUT, DELETE
234+ Access-Control-Expose-Headers: Link, X-RateLimit-Limit, X-RateLimit-Remaining, X-OAuth-Scopes, X-Accepted-OAuth-Scopes
235+ Access-Control-Max-Age: 86400
236+ Access-Control-Allow-Credentials: true
237+
204238##JSON-P Callbacks
205239
206240You can send a` ?callback ` parameter to any GET call to have the results