Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: allow cross origin loading for graphiql #775

Merged
merged 1 commit into from
Apr 25, 2022
Merged

fix: allow cross origin loading for graphiql #775

merged 1 commit into from
Apr 25, 2022

Conversation

conradthegray
Copy link
Contributor

@conradthegray conradthegray commented Apr 22, 2022

Fixes #771

unpkg is not setting up correct cross origin headers causing browsers to block scripts and styles loaded from them. The proposed change tells the browser to load the content from unpkg.

How to test the fix

  1. Create a test server (gist here)
  2. Run the test server and navigate to http://localhost:3000/graphiql
  3. You should see a blank page without the fix applied
  4. Apply the fix in mercurius-771/node_modules/mercurius/static/main.js file
  5. Reload the test server and navigate to http://localhost:3000/graphiql
  6. You should see GraphiQL interface

@@ -6,6 +6,7 @@ const importer = {
const script = document.createElement('script')
script.type = 'text/javascript'
script.src = url
script.crossOrigin = 'anonymous'

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor point, but the actual name of the property is 'crossorigin' (all lower case).

I know the camel case version works, and I know that html attribute names are case-insensitive, but I think I'd prefer to use the casing indicated by the spec.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

According to MDN, the proper name is crossOrigin when we refer to it from JS https://developer.mozilla.org/en-US/docs/Web/API/HTMLScriptElement
The fix won't work if the casing is changed to all lower case.

@simoneb
Copy link
Collaborator

simoneb commented Apr 25, 2022

@conradthegray can you please link the issue properly in the PR description?

@conradthegray conradthegray marked this pull request as ready for review April 25, 2022 10:59
Copy link
Collaborator

@simoneb simoneb left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Copy link
Contributor

@jonnydgreen jonnydgreen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@simoneb
Copy link
Collaborator

simoneb commented Apr 25, 2022

Build is failing but I don't see anything in this PR which may cause that. On the other hand the build is green on master and it doesn't have a history of failing, so I'm confused what's going on

@simoneb
Copy link
Collaborator

simoneb commented Apr 25, 2022

I'll go ahead and merge this. If the failure occurs on master, we'll look into it straight away

@simoneb simoneb merged commit 49e9a50 into mercurius-js:master Apr 25, 2022
@jonnydgreen
Copy link
Contributor

yeah that's very strange, I also can't see how this change would affect the tests. Looking at the file in question, it seems like this was initially observed when creating the relevant PR but the failures seemed to be fixed in later commits: #706 (comment) . To me, this suggests that it is intermittent so maybe a rerun of the jobs will be okay - like you mentioned, if it happens on master, we can take a closer look!

@simoneb
Copy link
Collaborator

simoneb commented Apr 25, 2022

master build is green 🤷

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Graphiql cannot be used with helmet on fresh browsers
4 participants