[openstreetmap/openstreetmap-website] gpx/create API dosn't work any more since recent website update (#1609)

[Tom Hughes]

It's fully supported for direct access, just not for cross origin loads from other web sites. It works fine when loading an openstreetmap.org URL directly in a browser or from a separate application like JOSM.

Because the authentication is, or can be, applied implicitly without user authorization or a case-by-case basis it simply isn't safe to allow it for cross origin loads because any random web site you visit could have background javascript that did things on osm.org as you without you ever even knowing.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/openstreetmap/openstreetmap-website/issues/1609#issuecomment-323528242
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstreetmap.org/pipermail/rails-dev/attachments/20170819/dc67b7c5/attachment-0001.html>