Allow CORS for objects.inv, or expose inventory in API?

[astrojuanlu]

I was playing with a proof of concept of a browser-based intersphinx viewer, but requests to GET objects.inv get blocked because of CORS.

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://docs.readthedocs.io/en/latest/objects.inv. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing). Status code: 200

I wonder if CORS access could be allowed for such files?

Alternatively, since the various APIs have CORS headers in place, I wonder if it would be possible to add an endpoint that would list the inventory of a project as a byte stream?

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[humitos]

We did change some CORS policies lately, but it seems this is still an issue.

[humitos]

I'm reopening it because we changed our logic to only add CORS headers on *.org.readthedocs.build domain. See #10751

[stsewd]

We allow cross site requests for all documentation content now. See https://docs.readthedocs.io/en/stable/security-implications.html#cross-origin-requests.