title: CORS on exportLinks for Google Docs spreadsheets not working
body: <p>As per <a href="https://developers.google.com/drive/web/manage-downloads" rel="nofollow">spec</a>, Google Docs can be downloaded in different formats using the appropriate <code>exportLinks</code> entry in the file metadata obtained using the Drive API. The URLs specified by these entries support CORS, so one can use them from pure Javascript, without a proxy.</p>
  
  <p>This works for most files and document types (doc, presentation) but not spreadsheets. When you try an XHR GET on a spreadsheet <code>exportLinks</code> URL from browser Javascript,</p>
  
  <ol>
  <li>The OPTIONS request returns a valid response, but it has an Expires header of <code>Fri, 01 Jan 1990 00:00:00 GMT</code></li>
  <li>The browser gives up at this point (probably due to the Expires)</li>
  <li>Doing a GET with the same Authorization, Referer, Origin headers using <code>curl</code> returns the spreadsheet alright, but the response headers don't contain any <code>Access-Control-Allow-Origin</code> header, so it wouldn't have worked from the browser.</li>
  </ol>
  
  <p>Other document types behave in the expected manner for OPTIONS and GET, returning correct Expires and CORS headers.</p>
  
  <p>In fact, old spreadsheets - those with exportLink URLs which look like <code>https://docs.google.com/feeds/download/spreadsheets/Export?key=XXX&amp;exportFormat=xlsx</code> also work. The problem is confined to new sheets, whose exportLink URLs look like <code>https://docs.google.com/spreadsheets/export?id=XXX&amp;exportFormat=xlsx</code>.</p>
  
  <p>I hit this issue with <a href="http://pigshell.com" rel="nofollow">pigshell</a> using the following steps:</p>
  
  <ol>
  <li>Visit <a href="http://pigshell.com" rel="nofollow">pigshell</a> using a desktop browser (Chrome/Firefox/Safari)</li>
  <li>Attach a Google account by clicking on the Google icon in the rightbar</li>
  <li><p>In the pigshell CLI,</p>
  
  <pre><code>cd /gdrive/&lt;username@gmail.com&gt;
  ls
  gcat &lt;docfilename&gt;                # Displays PDF version of doc
  gcat &lt;spreadsheetfilename&gt;        # CORS failure, examine browser console/devtools
  gcat &lt;spreadsheetcreatedyearsago&gt; # Works
  </code></pre></li>
  </ol>