Is this an issue with Pagure (the code) or how pagure.io is specifically set up as a server?

If it is the latter, we might need to bring this up with the infra guys.

This is an issue in code itself. Let me describe it better: I tried to write a Javascript application that would run in a browser, load data from Pagure and display it. When a browser makes the request, it needs to perform a cross-origin resource sharing check. It verifies that the server added HTTP headers that explicitly allow the resource to be used from another domain (in my case localhost). Since the header is not there, my browser would not let me make the request.

If you want to enable using the API from other origins, the server needs to add headers. I think this should be done in Pagure, as only the API should be accessible and nothing else. There is an extension for Flask that seems to do this. I have no experience with it though.

More details on CORS.

To use the API with jquery another approach is to return the callback, we did this with fedocal: https://github.com/fedora-infra/fedocal/blob/master/fedocal/api.py#L41

So we could just use the same mechanism here

I'd also welcome this feature. @lsedlar described what is needed. The approach written by pingou will probably not help here. The server needs to be able to respond properly to the pre-flight request (http method OPTIONS) with correct headers. The Flask extension might do it.

FYI: GitHub supports it.

Without it, JS applications need a proxy which would do the request on their behalf. These slow things down and make it more complex - e.g. I don't want my app to have its own server backend.