Comments (14)
I like to extend this request to include https://www.openhab.org/addons
from website.
Ehm guys, WDYT?
@ghys @Confectrician
from website.
For Discourse, you can PM your case to @admins
for review. This repo is only for the static website, not the forum.
I'm not in favor of it, it's strongly discouraged (https://meta.discourse.org/t/what-are-the-risks-of-enabling-cross-origin-resource-sharing-discourse-enable-cors/41248).
I'm aware the CORS spec disallows requests with credentials if Access-Control-Allow-Origin
is set to *
but it's still a bad idea IMO. Cross-domain access should be only reserved to benign, trustworthy domains under the openHAB Foundation's control.
As an alternative, you can take a look at the HABPanel widget gallery implementation https://github.com/openhab/org.openhab.ui.habpanel/tree/master/src/main/java/org/openhab/ui/habpanel/internal/gallery/community for an example of how to retrieve public data from Discourse with a server-side proxy.
As for this website, it's a lesser risk, but it's just static HTML and JS, cross-domain requests are usually for APIs and this site doesn't have one... can you explain your use case?
from website.
can you explain your use case?
Of course. My Paper UI design study.
-
I'm fetching community topics from the forum. I'm using a heroku proxy at the moment, so with or without cors I'll generate the same traffic. But with cors, the forum software could apply specific rate limiting. (I could imagine that the general access could be denied, but a special http header signals that it is openHab related software. Might help a bit.)
-
I'm showing inline documentation, fetched from /docs and /addons.
See http://davidgraeff.github.io/paperui-ng/
from website.
I'll generate the same traffic. But with cors, the forum software could apply specific rate limiting.
It's not about web traffic, it's about preserving the forum users' security and preventing random malicious sites from performing damaging requests on their behalf, or for spamming etc. CORS is vitally important for this.
I'm showing inline documentation, fetched from /docs and /addons.
You mean you want to extract the content from the pages, remove the headers and so on? That's kind of dirty :)
from website.
You mean you want to extract the content from the pages, remove the headers and so on? That's kind of dirty
I'm already doing it xD. And yeah I know, I could use the github content directly (and I'm doing that in other occasions), but the website script has already crawled everything together for me in this case. Would be even more awesome if the website crawler script could generate .json
files for machine consumption.
from website.
It's not about web traffic
Oh I thought it is about traffic only. I only need to issue GET requests. We could enable CORS for GET only for non-openhab domains.
from website.
Still an issue, you can access sensible information (e.g. private messages) with GET requests.
from website.
But as you stated, authentication headers (actually no headers at all) and also cookies are not allowed with CORS in the default settings.
from website.
What is the situation now?
With these headers it should be safe:
add_header 'Access-Control-Allow-Origin' '*' always;
add_header 'Access-Control-Allow_Credentials' 'false' always;
add_header 'Access-Control-Allow-Headers' 'Accept,Origin,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range' always;
add_header 'Access-Control-Allow-Methods' 'GET' always;
from website.
Friendly reminder ^^
from website.
Again, this is the website's repo, it has nothing to do with Discourse.
The list of admins which you should PM is at https://community.openhab.org/about (you can't message the group) and I believe it's @digitaldan who's doing the day-to-day maintenance.
As for the add-ons and docs I still don't believe allowing client-side scraping the website's HTML and embedding its content in an app is a valid approach. If there's a JSON file eventually generated with the needed info (e.g. the source URL on GitHub with the Markdown source for a particular page) we can then allow access to that and that only.
from website.
But yannick, that is all I wanted to know. You are not wanting to give access to the HTML pages, but you would accept to access a generated JSON file.
Thanks :)
from website.
That's because your original request was mainly about Discourse ;) and I didn't know if those able to grant or deny you that request were listening here or not. I personally don't have access to the Discourse server's configuration (only the in-app admin area).
from website.
Related Issues (20)
- Forum is broken: "your browser is too old to work on this site" HOT 6
- Add direct issue creation to 404 page
- Remove all hardcoded urls, where possible
- Background color of "code" blocks is not visible in dark theme
- Prompt users to install Java 17 on 4.0.0-SNAPSHOT download page
- Remove Twitter feed from website
- Forum down HOT 1
- Downloads Page for OH 4 Milestone still say to install Java 11
- No longer recommend Zulu Java HOT 1
- "Download openHAB 4.0.0 SNAPSHOT Add-ons" suggests wrong name HOT 6
- Current website and its consent banner are violating GDPR and TTDSG HOT 19
- Text in tabs is unreadable with dark mode
- /download should contain a link to a changelog
- Update Twitter references to X HOT 1
- The download page shows a snapshot download link when choosing Milestone
- Consent Banner Refactoring introduced some CSS issues HOT 2
- Redirect to local openHAB server
- Local build of webpage does not work on Ubuntu 22.04.4 LTS x86_64
- Describe how to use build artifact from a docu repo PR to create the webpage HOT 7
- openHAB logo broken on status page HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from website.