I have a notebook that I am trying to embed via the runtime, but I am running into CORS problems. The notebook in question is at
@innermatrix/integration-test. The error I am getting is
Access to script at ‘https://api.observablehq.com/@innermatrix/integration-test’ from origin […] has been blocked by CORS policy: No ‘Access-Control-Allow-Origin’ header is present on the requested resource.
And indeed it is missing:
$ curl -s -D- -o /dev/null https://api.observablehq.com/@innermatrix/integration-test"?v=1" | grep -i allow-origin
shows nothing whereas for the hello world notebook I see
$ curl -s -D- -o /dev/null https://api.observablehq.com/@observablehq/hello-world.js\?v\=3 | grep -i allow-origin access-control-allow-origin: *
I tried both public and unlisted sharing for my notebook, and got the same error.