-
Notifications
You must be signed in to change notification settings - Fork 111
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
refactor: apply cors #5365
refactor: apply cors #5365
Conversation
6ed7ed9
to
0b2aa77
Compare
0b2aa77
to
5310e37
Compare
I think this PR is ready for review. Perhaps the only concern is ever want to drop |
5310e37
to
e75d155
Compare
We have third party dependencies which require unsafe-eval, unless we get them compliant with cso it would be difficult. |
@himadrisingh if vega is the mentioned one, it seems they have a resolution, I tried opening a PR for discussion at: |
As @djbarnwal has already made great contribution and there has been an upstream PR for vega to review, I think we can deal with CSP later. |
Did we test it locally and see if it fixes the issue. |
@himadrisingh Yeah, here’s what I tested locally:
go run ./cli start --verbose --debug <local-rill-project-path> --allowed-origins="http://localhost:3000" --allowed-origins="http://localhost:4000" This sets the allowed origins to
python3 -m http.server 4003 With an HTML file like this: <!DOCTYPE html>
<html>
<head>
<title>
CORS Test
</title>
</head>
<body>
<script>
fetch("http://<HOST-A-IP>:9009/v1/instances/default?sensitive=true")
.then(res => res.json())
.then(data => console.log(data))
.catch(err => console.error("Error: ", err));
</script>
</body>
</html> When the port of HOST B is set to |
Description
*
to the default local HTTP URL (usuallyhttp://localhost:9009
)--allowed-origins
to provide additional allowed originsExample: Specifying an additional allowed origin
rill start --allowed-origins="http://rill.local"
Motivation
Resolve #5039