4 ms·

Anyone have any idea how one might do this in a Ghost Blog? Outside of putting cloud flare in front?

by imwillofficial 6y ago

afrazkhan 6y ago
Put Nginx in front.
- imwillofficial 6y ago
  No.
shakna 6y ago
Add the HTML equivalent to the document head: <meta http-equiv="Permissions-Policy" content="interest-cohort=()" />
- mellavora 6y ago
  Hey, thanks for this! I've seen several posts now saying that all you need to do is add ``` Permissions-Policy: interest-cohort=() ``` somewhere, but they all seemed to assume that everyone knew where that where was (nginx config? webserver config? index.html? ??? ??????
  - majewsky 6y ago
    It's an HTTP header, so follow the documentation for your tooling for how to add custom HTTP headers.
  - shakna 6y ago
    When you see something along the lines of: Foo: things This will generally be a HTTP Header. How you add that depends on your server/framework. (And will be well documented). If you've only got a static site, then you can always fallback and use HTML to achieve the same thing with http-equiv, which gets added to the head element: <meta http-equiv="Foo" content="things" /> For example to redirect to /foo after 3 seconds: <meta http-equiv="Refresh" content="3; /foo" /> It's a little off the beaten track for most people, but the kind of knowledge a web developer can be expected to know, or know where to look in the documentation. Hopefully that can help you in your future endeavours.
- pdenton 6y ago
  I don't think the meta version of Permissions-Policy ever got implemented. "http-equiv" isn't a magic "here's a HTTP header I forgot to mention" pixie dust. Better stick to the actual recommendation of adding the header in the server configuration.
  - imwillofficial 6y ago
    In my case I don’t have access to the server configuration. I’m running a blog with Ghost Pro, is the above a reasonable workaround?
  - shakna 6y ago
    Whilst http-equiv is said to be an enumerated value, so far as I know in Chrome, it actually is "magic HTTP Header pixie dust": [0] And whilst in Firefox parsing of the element is more spread out, they accept a very wide number of headers that aren't documented, and you'll find examples on MDN for any number of headers using http-equiv which aren't specified in the standard or on their docs for http-equiv itself [2] (For example, X-DNS-Prefetch-Control [1]). [0] https://source.chromium.org/chromium/chromium/src/+/master:out/Debug/gen/third_party/blink/renderer/bindings/core/v8/v8_html_meta_element.cc;l=95;drc=65edd51497213d077fa26bb4f24ab2341b243074;bpv=1;bpt=1?q=metaelement.c&ss=chromium https://source.chromium.org/chromium/chromium/src/+/master:o... [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-DNS-Prefetch-Control https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-... [2] https://developer.mozilla.org/en-US/docs/Web/HTML/Element/meta#attr-http-equiv https://developer.mozilla.org/en-US/docs/Web/HTML/Element/me...

Anyone have any idea how one might do this in a Ghost Blog? Outside of putting cloud flare in front?

afrazkhan 6y ago

Put Nginx in front.

imwillofficial 6y ago
No.

shakna 6y ago

Add the HTML equivalent to the document head: <meta http-equiv="Permissions-Policy" content="interest-cohort=()" />

mellavora 6y ago
Hey, thanks for this! I've seen several posts now saying that all you need to do is add ``` Permissions-Policy: interest-cohort=() ``` somewhere, but they all seemed to assume that everyone knew where that where was (nginx config? webserver config? index.html? ??? ??????
- majewsky 6y ago
  It's an HTTP header, so follow the documentation for your tooling for how to add custom HTTP headers.
- shakna 6y ago
  When you see something along the lines of: Foo: things This will generally be a HTTP Header. How you add that depends on your server/framework. (And will be well documented). If you've only got a static site, then you can always fallback and use HTML to achieve the same thing with http-equiv, which gets added to the head element: <meta http-equiv="Foo" content="things" /> For example to redirect to /foo after 3 seconds: <meta http-equiv="Refresh" content="3; /foo" /> It's a little off the beaten track for most people, but the kind of knowledge a web developer can be expected to know, or know where to look in the documentation. Hopefully that can help you in your future endeavours.
pdenton 6y ago
I don't think the meta version of Permissions-Policy ever got implemented. "http-equiv" isn't a magic "here's a HTTP header I forgot to mention" pixie dust. Better stick to the actual recommendation of adding the header in the server configuration.
- imwillofficial 6y ago
  In my case I don’t have access to the server configuration. I’m running a blog with Ghost Pro, is the above a reasonable workaround?
- shakna 6y ago
  Whilst http-equiv is said to be an enumerated value, so far as I know in Chrome, it actually is "magic HTTP Header pixie dust": [0] And whilst in Firefox parsing of the element is more spread out, they accept a very wide number of headers that aren't documented, and you'll find examples on MDN for any number of headers using http-equiv which aren't specified in the standard or on their docs for http-equiv itself [2] (For example, X-DNS-Prefetch-Control [1]). [0] https://source.chromium.org/chromium/chromium/src/+/master:out/Debug/gen/third_party/blink/renderer/bindings/core/v8/v8_html_meta_element.cc;l=95;drc=65edd51497213d077fa26bb4f24ab2341b243074;bpv=1;bpt=1?q=metaelement.c&ss=chromium https://source.chromium.org/chromium/chromium/src/+/master:o... [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-DNS-Prefetch-Control https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-... [2] https://developer.mozilla.org/en-US/docs/Web/HTML/Element/meta#attr-http-equiv https://developer.mozilla.org/en-US/docs/Web/HTML/Element/me...