It seems to me that the problem is that the backend is treating the XHR like if you were hitting the main site. So sometimes (but not for all endpoints I think), if I were logged out, the XHR would be redirected to the login page.
To me, the API endpoints should behave the same way in a browser as with curl without ever redirecting to the login page.
But, once again, it might have been fixed in the meantime… I haven't tried recently.
Comments
It seems to me that the problem is that the backend is treating the XHR like if you were hitting the main site. So sometimes (but not for all endpoints I think), if I were logged out, the XHR would be redirected to the login page.
To me, the API endpoints should behave the same way in a browser as with curl without ever redirecting to the login page.
But, once again, it might have been fixed in the meantime… I haven't tried recently.
Sure. I haven't tried either. Its on my list of stuff to dig into and sort out, so hopefully we have a better answer soon.