Preflight requests to


I’m trying to pull raw files from GitHub via js in browser. Public files work great, but when I try to get private files, the request fails due to *rejecting the OPTIONS preflight request* with 403.

Curling on command line, it works fine with an access token, because curl doesn’t preflight.

\>curl -is https://$ACCESS\$SLUG/master/module.json  
HTTP/1.1 200 OK

If I manually preflight, the problem appears again:

\> curl -is -H "Origin: http://localhost:3499" -H "Access-Control-Request-Method:GET" -H "Access-Control-Request-Headers: X-Requested-With" -X OPTIONS https://$ACCESS\$SLUG/master/module.json  
HTTP/1.1 403 Forbidden  

I can get the file contents from the content API, but that’s clunky because stuff always seems to be base64, even with the raw media type (seems to just strip enclosing json metadata).

Could you please consider looking into supporting OPTIONS on Or is there something I could do with the content api to get raw file contents?




Thanks for reaching out.

I’ll pass along the feedback to the development team. I can’t make any promises or give an ETA on when something might change, but your request will be in the hands of the appropriate people.

Thanks again for letting us know.


I am getting the same problem but with simple public files. Was there a recent change?