LBRYCommunity/spee.ch

Fork 0

Add support for CORS #624

New issue

Open

opened 2018-10-10 00:31:45 +02:00 by NetOpWibby · 5 comments

NetOpWibby commented

2018-10-10 00:31:45 +02:00

(Migrated from github.com)

For the meme creator on .tech, I was linking to images hosted on spee.ch. However, security issues prevented publishing. From MDN:

As soon as you draw into a canvas any data that was loaded from another origin without CORS approval, the canvas becomes tainted. A tainted canvas is one which is no longer considered secure, and any attempts to retrieve image data back from the canvas will cause an exception to be thrown.

For the meme creator on .tech, I was linking to images hosted on spee.ch. However, security issues prevented publishing. From [MDN](https://developer.mozilla.org/en-US/docs/Web/HTML/CORS_enabled_image): > As soon as you draw into a canvas any data that was loaded from another origin without CORS approval, the canvas becomes **tainted**. A tainted canvas is one which is no longer considered secure, and any attempts to retrieve image data back from the canvas will cause an exception to be thrown.

kauffj commented

2018-10-10 16:06:35 +02:00

(Migrated from github.com)

CORS doesn't allow multiple allowed origins, so the options are:

Send Access-Control-Allow-Origin: * and accept security downsides
Check if referrer is from [lbry.tech, lbry.io, lbry.fund, ???] and return Access-Control-Allow-Origin: <allowed_domain>.

CORS doesn't allow multiple allowed origins, so the options are: 1) Send `Access-Control-Allow-Origin: *` and accept security downsides 2) Check if referrer is from `[lbry.tech, lbry.io, lbry.fund, ???]` and return `Access-Control-Allow-Origin: <allowed_domain>`.

kauffj commented

2018-12-10 22:47:40 +01:00

(Migrated from github.com)

@NetOperatorWibby can you confirm this is working as intended for you now?

NetOpWibby commented

2018-12-12 19:47:12 +01:00

(Migrated from github.com)

@kauffj Just remembered this. It is not working as intended.

SecurityError: The operation is insecure.

This is only with linking images from spee.ch to the meme creator on the Playground. The spee.ch images linked on the community page on .tech work. Publishing with images not served from .tech itself creates the above error.

@kauffj Just remembered this. It is _not_ working as intended. ``` SecurityError: The operation is insecure. ``` This is only with linking images from spee.ch to the meme creator on the Playground. The spee.ch images linked on the community page on .tech work. Publishing with images not served from .tech itself creates the above error.

jessopb commented

2018-12-12 22:41:10 +01:00

(Migrated from github.com)

@NetOperatorWibby can you describe the steps to test this?
Alternately, can you verify that it's a problem for all browsers or specific browsers?

@NetOperatorWibby can you describe the steps to test this? Alternately, can you verify that it's a problem for all browsers or specific browsers?

NetOpWibby commented

2018-12-12 22:50:10 +01:00

(Migrated from github.com)

@jessopb

Check out lbry.tech locally
Uncomment the lines in this section: https://github.com/lbryio/lbry.tech/blob/master/app/sockets.js#L196-L213
Go to /playground and visit the Publish example
Make sure you have your browser inspector open and the console tab is activated
Hit "Submit"

This issue affects Firefox and Chrome. The issue persists in production as well.

@jessopb - Check out lbry.tech locally - Uncomment the lines in this section: https://github.com/lbryio/lbry.tech/blob/master/app/sockets.js#L196-L213 - Go to `/playground` and visit the Publish example - Make sure you have your browser inspector open and the console tab is activated - Hit "Submit" This issue affects Firefox and Chrome. The issue persists in production as well.

👍 1

This discussion has been locked. Commenting is limited to contributors.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: LBRYCommunity/spee.ch#624

No description provided.

Rows
Columns