To work around JavaScript same-origin policy, allowing to call into base.swh from www.swh, we should add [[ https://en.wikipedia.org/wiki/JSONP | JSONP ]] support to the public facing API.
Other common solutions are currently not viable for us:
- CORS requires fiddling with HTTP headers (impossible using Gandi simple-hosting)
- HTTP-level redirection (e.g., www.swh/api/* → api.swh/api/) cannot be setup as a Gandi webredir, which only supports whole-domain redirections
JSONP is feasible. We need to add support for ?jsonp=functionname to all functions in our API front-end.