5 ms·
> Typically this is possible. Images aren't subject to CORS. You're right, that was a misleading example. I changed it to data.json to be more clear. > If you
by pfraze 8y ago
> Typically this is possible. Images aren't subject to CORS.
You're right, that was a misleading example. I changed it to data.json to be more clear.
> If you publish a dat archive, how do you notify Hashbase to pin it? Can you do it through dat? Does it require setting up an account on Hashbase, providing an email address, linking a credit card, etc.?
The "Pinning" system is very similar to Git remotes. You can pin using any endpoint that complies with https://www.datprotocol.com/deps/0003-http-pinning-service-api/ https://www.datprotocol.com/deps/0003-http-pinning-service-a.... So, similar to a git remote, you do need some kind of authentication with the pinning service - unless somebody writes one that's open for anybody to push to.
The UX flow will be similar to a git remote as well, you use an HTTPS to tell the server to sync the dat. So, it's an explicit user action.
We've got two nodejs implementations of the pinning service API you can self-deploy, https://github.com/beakerbrowser/hashbase https://github.com/beakerbrowser/hashbase and https://github.com/beakerbrowser/homebase https://github.com/beakerbrowser/homebase, and then we run a Hashbase instance at hashbase.io
- panarky 8y ago>> Typically this is possible. Images aren't subject to CORS. > You're right, that was a misleading example. I changed it to data.json to be more clear. CORS doesn't preflight GET, POST or HEAD methods unless they have custom headers or content-type other than application/x-www-form-urlencoded, multipart/form-data or text/plain. So a simple GET bar.com/data.json works just fine in today's browsers. https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
- pfraze 8y agoI'd be happy to be corrected on this, but here's what I understand: While fetch doesn't preflight for GET, it does require an Access-Control-Allow-Origin header. You can specify `no-cors` in the mode to circumvent this, but then you cant access the response body (https://developer.mozilla.org/en-US/docs/Web/API/Request/mode https://developer.mozilla.org/en-US/docs/Web/API/Request/mod...)
- panarky 8y agoHere's an example using your own site. Open the console in an empty Chrome window and paste this: fetch('https://pfrazee.hashbase.io/feed.xml') .then(response => response.text()) .then(str => console.log(str)) You'll get your RSS feed, no CORS tricks required.
- pfraze 8y agoMy site has the Access-Control-Allow-Origin:* header set. Try the same thing on the Beaker site in the devtools for https://example.com https://example.com. fetch('https://beakerbrowser.com/dat.json') .then(response => response.text()) .then(str => console.log(str)) It should fail
- dsp1234 8y agoor content-type other than application/x-www-form-urlencoded, multipart/form-data or text/plain. application/json is a content-type other than application/x-www-form-urlencoded, multipart/form-data or text/plain, and thus a request for it will fail unless the required CORS headers are present
- zerocrates 8y agoThere's a couple issues with your comment: first, the restriction you're talking about is related to preflighting, not to whether requests are allowed at all. Additionally, you're thinking about the "wrong" Content-type header: the limitation you're mentioning about urlencoded and so on is a limitation on request headers, not response headers. The CORS headers are required for the GP's described request to succeed, but not for the reasons you give.
- zerocrates 8y agoIn the absence of CORS header configuration on the target site, you can't use XHR or Fetch to get anything from a different domain. It doesn't matter if it's JSON, an image, or plain text. To some extent, you're conflating some of the requirements to avoid preflighting with cross-origin requests simply being allowed, and they're not the same.