JsonpResponse subclass of HttpResponse helps easily create JSONP-encoded responses.

[brigh...@gmail.com]

Django 1.7  realease JsonResponse subclass of HttpResponse helps easily create JSON-encoded responses.

As discussed in https://code.djangoproject.com/ticket/17942#comment:6

• Trying to support JSONP callbacks would require to somehow allow Cross-origin resource sharing. I would say it's not needed for most use cases.
  

JsonpResponse isn't needed for most use cases. But is needed for some use cases.

What do you think about adding JsonpResponse subclass of HttpResponse.

The pr is https://github.com/django/django/pull/6455

[Yoong Kang Lim]

Would it be better to add an optional parameter to the constructor of JsonResponse instead of a new subclass?

--
You received this message because you are subscribed to the Google Groups "Django developers (Contributions to Django itself)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to django-develop...@googlegroups.com.
To post to this group, send email to django-d...@googlegroups.com.
Visit this group at https://groups.google.com/group/django-developers.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-developers/00730c97-df1c-4dc9-9594-506f01988240%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Florian Apolloner]

On Saturday, April 16, 2016 at 4:06:04 AM UTC+2, brigh...@gmail.com wrote:

JsonpResponse isn't needed for most use cases. But is needed for some use cases.

Like which? I think this should better live outside of Django.

[Tom Christie]

JSONP is essentially a browser hack.

There have been security issues raised around it, and we I don't believe we should encourage its usage by including it in Django core.

(If anything we *might?* want to consider CORS for built-in support at some point.)

I'd agree with Florian here - I'd rather see this as either a third party package, a code snippet that's shared on a blog post, or similar.

  - Tom

[Joey Wilhelm]

Agreed on discouraging (or at least not actively encouraging) the use of JSONP. Everything I've read on it has started with big "Do not try this at home!" warnings.

I also very strongly agree on built-in support for CORS, especially elements of DRF getting more tightly integrated into the core. I think CORS is an absolutely essential component if Django is going to claim to be able to support a REST API out of the box, primarily because of the trend of using domain.com for an app, and api.domain.com for the backend.

-Joey

--

You received this message because you are subscribed to the Google Groups "Django developers (Contributions to Django itself)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to django-develop...@googlegroups.com.
To post to this group, send email to django-d...@googlegroups.com.
Visit this group at https://groups.google.com/group/django-developers.

To view this discussion on the web visit https://groups.google.com/d/msgid/django-developers/37f473d0-8654-4774-82aa-adaf23ea49ab%40googlegroups.com.