[Csnd] [OT] fetch question

The Csound Mailinglist
1

I get confused as to what we are allowed to fetch. For example, say we have the code

fetch(srcf).then((x) => { bx = x })

Some URLs seem to be fetched while others fail to fetch. For example,
I tried to fetch from Steven’s site

https://www.kunstmusik.com/mp3/hidden_laws.mp3

and it failed. But I can fetch the index.html from

Both are CORS but one can be fetched and the other can’t. Does anyone have a clue?

2

I have no idea, is it because one is http while the other is https?

3

I don’t think it makes any difference

Prof. Victor Lazzarini
Maynooth University
Ireland

4

I just tried it Mac, 10\.14 - both Firefox and Safari reject the site "invalid certificate", or "unsafe", while Chrome is OK with it.
So it looks like a "YMMV" sort of situation.

Richard Dobson

I don't think it makes any difference

Prof. Victor Lazzarini
Maynooth University
Ireland

  *Warning*

This email originated from outside of Maynooth University's Mail System. Do not reply, click links or open attachments unless you recognise the sender and know the content is safe.

I have no idea, is it because one is http while the other is https?

...

Csound mailing list
Csound@listserv.heanet.ie

Send bugs reports to
        Issues · csound/csound · GitHub
Discussions of bugs and features can be posted here

5

https://developer.mozilla.org/en-US/docs/Web/API/fetch

Parameters kept changing through the past several years. Just try combinations.

6

I can view both of these, and the first example plays fine. That’s on macOS Ventura 131 with Chrome Version 108.0.5359.124 (Official Build) (arm64).

7

My problem is not viewing or playing (/downloading). The problem is using the fetch API (e.g. with the code I showed).

8

yes cross origin fetching is always risky. The amount of factors determining if fetch will succeed are many. Cors is the most common issue for rejection, but rejection can also vary from CSP (content-security-policy) referrer-policy https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy, Strict-Transport-Security Header (HSTS), X-Frame options if it’s running in an iframe (which I believe all sandboxes do), there are also two new security headers which are required for making sharedarraybuffer work: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Resource-Policy and https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Opener-Policy