issue_comments

Wrote this up as a TIL: https://til.simonwillison.net/http/testing-cors-max-age

Mystery solved as to why I wasn't seeing this work:

I had "Disable Cache" checked!

I ran this experiment after un-checking that box:

javascript fetch('https://latest.datasette.io/ephemeral/foo/1/-/update', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ test: 'test' }) }); // And run it again fetch('https://latest.datasette.io/ephemeral/foo/1/-/update', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ test: 'test' }) }); // Now try a thing that doesn't serve that max-age header yet: fetch('https://latest-with-plugins.datasette.io/ephemeral/foo/1/-/update', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ test: 'test' }) }); // And a second time but within 5s fetch('https://latest-with-plugins.datasette.io/ephemeral/foo/1/-/update', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ test: 'test' }) }); // Third time after waiting longer than 5s fetch('https://latest-with-plugins.datasette.io/ephemeral/foo/1/-/update', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ test: 'test' }) }); // Try that original one again - still within the 1hr cache time fetch('https://latest.datasette.io/ephemeral/foo/1/-/update', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ test: 'test' }) }); The results show that the cache of 1hr was being obeyed for latest.datasette.io while the latest-with-plugins.datasette.io default cache of 5s was being obeyed too.

https://fetch.spec.whatwg.org/#http-access-control-max-age says:

Indicates the number of seconds (5 by default) the information provided by the Access-Control-Allow-Methods and Access-Control-Allow-Headers headers can be cached.

So there was already a 5s cache anyway.

Weird... after the deploy went out:

But the request did indeed get the new header:

So I'm not sure why it's making multiple POST requests like that.

Maybe it's because the attempted POST failed with a 404?

Updated docs: https://docs.datasette.io/en/latest/json_api.html#enabling-cors

I ran this on https://www.example.com/ twice using the console: javascript fetch( `https://latest.datasette.io/ephemeral/foo/1/-/update`, { method: "POST", mode: "cors", headers: { Authorization: `Bearer tok`, "Content-Type": "application/json", }, body: JSON.stringify({update: {blah: 1}}), } ) .then((r) => r.json()) .then((data) => { console.log(data); }); And got this in the network pane:

I'm going with 3600 for 1 hour instead of 600 for 10 minutes.

Also need to update this documentation:

https://github.com/simonw/datasette/blob/9584879534ff0556e04e4c420262972884cac87b/docs/json_api.rst?plain=1#L453-L465

Or maybe make that automated via cog.