[openstreetmap/openstreetmap-website] gpx/create API dosn't work any more since recent website update (#1609)

[Tom Hughes]

Well it wasn't an intentional change but the old configuration was unintentional as well in that we added CORS support to a site that already had basic auth support without realising the potential consequences.

Equally basic authentication has really been deprecated pretty much since OAuth was added though we don't have a formal timetable for removing it.

I'm very reluctant to re-enable this for any endpoints - not only does it potentially allow a malicious site to extract information it would also allow it to, for example, make edits in your name.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/openstreetmap/openstreetmap-website/issues/1609#issuecomment-321667130
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstreetmap.org/pipermail/rails-dev/attachments/20170810/87c798cd/attachment.html>