Cannot download favicon for URLs

[saschabrockel]

If I want to download a favicon for any URL in some entry I'll get:

Refused to load the image 'https://services.keeweb.info/favicon/mein.ionos.de' because it violates the following Content Security Policy directive: "img-src 'self' data: blob: https://favicon.keeweb.info".

And it is also telling:

keeweb?config=config?file=%2FSingh.kdbx:1 2022-08-17T02:39:35.837Z [icon-select-view] Favicon download error: https://services.keeweb.info/favicon/mein.ionos.de Event {isTrusted: true, type: 'error', target: img, currentTarget: img, eventPhase: 2, …}
r.error @ keeweb?config=config?file=%2FSingh.kdbx:1
t.onerror @ keeweb?config=config?file=%2FSingh.kdbx:1
error (async)
downloadIcon @ keeweb?config=config?file=%2FSingh.kdbx:1
eventListener @ keeweb?config=config?file=%2FSingh.kdbx:1
e @ keeweb?config=config?file=%2FSingh.kdbx:1

It never worked. Does anybody have an idea how to fix this?

[arnowelzel]

What exactly is the context of this? What to you mean with "download a favicon for any URL"?

Edit: in general, JavaScript will not download data from any server at all as long as the server content Cross-Origin-Resource-Sharing policy (CORS) does not allow that. So the target server has to allow JavaScript loaded from other servers to access its data, which is usually never the case.

[saschabrockel]

@arnowelzel the function exists also if you use https://app.keeweb.info/.

If you press this button here it should download the favicon from the website if it is available:

So you say it is a CORS problem? How to fix it for a Nextcloud instance then?

After downloading / pressing the button:

On app.keeweb.info it works.

[Slug-V]

I tried to reproduce the issue and got a CORS error about https://services.keeweb.info/favicon/(entry URL).

I put https://favicon.keeweb.info as img-src in 3151df3, but I found this URL was changed 2020.
I'll make another PR, which replaces the URL , and change doublequote to singlequote which violates Nextcloud coding guideline.

[Slug-V]

First, I just changed from "https://favicon.keeweb.info" to 'https://services.keeweb.info' in my environment.
The error disappeared, but keeweb won't get favicon, and another CORS error appeared.

Refused to connect to 'https://services.keeweb.info/favicon/(domain)' because it violates the following Content Security Policy directive: "connect-src 'self' https://plugins.keeweb.info".

So, I added 'https://services.keeweb.info' as AllowedConnectDomain, but this change had no effect.

hmm.
The console still claims "connect-src 'self' https://plugins.keeweb.info" and there's no https://services.keeweb.info, this is curious.
I think I wrote something wrong, but I can't understand how to solve it.

[Slug-V]

Successfully downloaded on another PC.
Okay, it'll be caching issue. making PR.

[saschabrockel]

@Slug-V it seems to be broken again but I think it is an error of the main app of keeweb because app.keeweb.info doesn't work either for me. Same for you?

[Slug-V]

Mostly same.
No response from nextcloud-keeweb, won't use from app.keeweb.info(but devtools says it's a CORS issue), and cannot use if you directly access https://services.keeweb.info/favicon/{domainname} via browser.

app.keeweb.info doesn't work

it has an extremely slow loading, but worked for me.

[arnowelzel]

For me it does not work on app.keeweb.info either and I don't know how to fix that anyway and the upstream KeeWeb is not maintained any longer (also see #221). So sorry, I can not do anything about this.