3 ms·

PSA: enable CORS[1] so people can make cross-origin requests without having to run a proxy. PSA #2: set things up so the author field of your feed includes you

by cxr 4y ago

PSA: enable CORS[1] so people can make cross-origin requests without having to run a proxy. PSA #2: set things up so the author field of your feed includes your email address (e.g. "Alice <alice@example.org>") and not just your bare name, so people can more easily get in touch with you without having to click through to the original post and then hunt around for your contact page; otherwise, you might never find out it's broken[2]. 1. <https://enable-cors.org https://enable-cors.org> 2. <https://pointersgonewild.com/2019/11/02/they-might-never-tell-you-its-broken/ https://pointersgonewild.com/2019/11/02/they-might-never-tel...>

dont__panic 4y ago
Curious why you recommend 1). Personally, I just don't use Javascript in my blog posts. But maybe I'm missing a use-case here? I should really add my email address to my news feed though.
- djbusby 4y ago
  It's so my domain can request from your domain using client side JS on my page, loading your RSS with a cross origin request.
- cxr 4y ago
  I don't understand your remark about "Javascript in my blog posts" or how it relates to CORS. In theory, it should be trivial to make simple, truly "serverless", web-based feed readers like AirSS[1][2]. In practice, many people are prevented from doing this, because the feeds they're interested in are hosted on servers that don't support CORS, which leads to really annoying workarounds (like needing to use a proxy or a separate browser extension, etc.) 1. <https://github.com/derek-zhou/airss https://github.com/derek-zhou/airss> 2. <https://news.ycombinator.com/item?id=28730630 https://news.ycombinator.com/item?id=28730630>
  - dont__panic 4y ago
    Makes sense. I should disable CORS on my blog, then! I normally use a dedicated feed reader, rather than a browser, but it makes sense to accommodate both use cases.
    - dont__panic 4y ago
      EDIT: I mean enable, not disable.
vanilla_nut 4y ago
For those of you wondering if your GitHub Pages site enables CORS: it does by default!
deleted 4y ago
[deleted]

by cxr 4y ago

dont__panic 4y ago

Curious why you recommend 1). Personally, I just don't use Javascript in my blog posts. But maybe I'm missing a use-case here? I should really add my email address to my news feed though.

djbusby 4y ago
It's so my domain can request from your domain using client side JS on my page, loading your RSS with a cross origin request.
cxr 4y ago
I don't understand your remark about "Javascript in my blog posts" or how it relates to CORS. In theory, it should be trivial to make simple, truly "serverless", web-based feed readers like AirSS[1][2]. In practice, many people are prevented from doing this, because the feeds they're interested in are hosted on servers that don't support CORS, which leads to really annoying workarounds (like needing to use a proxy or a separate browser extension, etc.) 1. <https://github.com/derek-zhou/airss https://github.com/derek-zhou/airss> 2. <https://news.ycombinator.com/item?id=28730630 https://news.ycombinator.com/item?id=28730630>
- dont__panic 4y ago
  Makes sense. I should disable CORS on my blog, then! I normally use a dedicated feed reader, rather than a browser, but it makes sense to accommodate both use cases.
  - dont__panic 4y ago
    EDIT: I mean enable, not disable.

vanilla_nut 4y ago

For those of you wondering if your GitHub Pages site enables CORS: it does by default!

deleted 4y ago

[deleted]