Project

General

Profile

Bug #17202

Updated by Tom Clegg about 3 years ago

When using keep-web to serve inline image content, Workbench2 uses URLs like these: 

 <pre> 
 https://ce8i5-4zz18-ykh8x2x89lq6iet.collections.zzzzz.example.com/IMG_20140713_123631.jpg?api_token=v2/example/secretsecrettoken 

 https://collections.zzzzz.example.com/c=ce8i5-4zz18-ykh8x2x89lq6iet/t=secretsecrettoken/IMG_20140713_123631.jpg 
 </pre> 

 There are two problems, which together make it impossible for Workbench2 to serve previews: 
 # keep-web responds to the first form with HTTP 303, an equivalent URL with the token part removed, and a cookie containing the token. This is a third-party cookie, which modern browsers reject to avoid XSS attacks, so the 2nd request fails 401. 
 # keep-web has no way of accepting a v2 token in the 2nd form, because a v2 token contains "/" character. 

 Proposed solutions: 
 # Keep-web should skip the 303-with-cookie behavior when serving inline content as a third party, i.e., when the request Origin header value is non-empty. This way Workbench2 can show inline images with @<img crossorigin="anonymous" src="...">@. _(this part is done & merged, see notes 4-6)_ 
 # Keep-web should accept an URL-encoded token in the path, like @/t=v2%2Fexample%2Fsecretsecrettoken/...@ (note this will be confusing because the % escape character will need to be escaped in order to appear in a URL: @/t=v2%252Fexample%252Fsecretsecrettoken/...@) 

Back