refactor: apply cors #5365
refactor: apply cors #5365
Conversation
6ed7ed9
to
0b2aa77
Compare
0b2aa77
to
5310e37
Compare
|
I think this PR is ready for review. Perhaps the only concern is ever want to drop |
5310e37
to
e75d155
Compare
|
We have third party dependencies which require unsafe-eval, unless we get them compliant with cso it would be difficult. |
@himadrisingh if vega is the mentioned one, it seems they have a resolution, I tried opening a PR for discussion at: |
As @djbarnwal has already made great contribution and there has been an upstream PR for vega to review, I think we can deal with CSP later. |
|
Did we test it locally and see if it fixes the issue. |
@himadrisingh Yeah, here’s what I tested locally:
go run ./cli start --verbose --debug <local-rill-project-path> --allowed-origins="http://localhost:3000" --allowed-origins="http://localhost:4000"This sets the allowed origins to
python3 -m http.server 4003With an HTML file like this: <!DOCTYPE html>
<html>
<head>
<title>
CORS Test
</title>
</head>
<body>
<script>
fetch("http://<HOST-A-IP>:9009/v1/instances/default?sensitive=true")
.then(res => res.json())
.then(data => console.log(data))
.catch(err => console.error("Error: ", err));
</script>
</body>
</html>When the port of HOST B is set to |
Description
*to the default local HTTP URL (usuallyhttp://localhost:9009)--allowed-originsto provide additional allowed originsExample: Specifying an additional allowed origin
rill start --allowed-origins="http://rill.local"Motivation
Resolve #5039