Issue with Relative Path Causing CORS Error on Discourse Sites

Yt.w · October 27, 2024, 6:27am

The following code in lib/highlight_js.rb works on some domains but not others:

def self.path
    "/highlight-js/#{Discourse.current_hostname}/#{version SiteSetting.highlighted_languages}.js"
end

I have two Discourse sites. This code works on the domain www.abc.com, but it doesn’t work on efg.com. In the browser console, I see the following error:

formatter.js:383 Uncaught (in promise) TypeError: Failed to resolve module specifier '/highlight-js/efg.com/9797975efac87d28baa695ae13ca72ccaf5120f5.js'. The base URL is about:blank because import() is called from a CORS-cross-origin script.

After modifying self.path in highlight_js.rb as follows:

def self.path
    "https://#{Discourse.current_hostname}/highlight-js/#{Discourse.current_hostname}/#{version SiteSetting.highlighted_languages}.js"
end

the issue was resolved.

It appears that using a relative path like
import('/highlight-js/efg.com/9797975efac87d28baa695ae13ca72ccaf5120f5.js')
causes a CORS issue, while using an absolute URL,
import('https://efg.com/highlight-js/efg.com/9797975efac87d28baa695ae13ca72ccaf5120f5.js') , works fine.

NateDhaliwal · October 27, 2024, 8:22am

Odd that it works with abc.com but not efg.com, since the 2 different routes are completely different

Yt.w · October 27, 2024, 9:04am

I mean it works with www.abc.com but not efg.com, not sure why but it happens on my cases

simonk · October 28, 2024, 11:49am

Are you using a CDN on either of these sites? I have noticed that code highlighting is no longer working on my site, and I think it’s because of this:

In my case, my CDN is not returning an Access-Control-Allow-Origin header for the highlightjs file. I notice that Meta’s CDN does include that header, so I wonder what is different.

$ curl --silent -I https://d3bpeqsaub0i6y.cloudfront.net/highlight-js/meta.discourse.org/9797975efac87d28baa695ae13ca72ccaf5120f5.js | grep -i access-control
access-control-allow-origin: *
access-control-allow-methods: GET, HEAD, OPTIONS

However, those headers are not being served by the origin server:

$ curl --silent -I https://meta.discourse.org/highlight-js/meta.discourse.org/9797975efac87d28baa695ae13ca72ccaf5120f5.js | grep -i access-control
<no output>

As far as I can tell, Discourse is meant to add access-control headers to the highlightjs files:

github.com

discourse/discourse/blob/27c20eeacd0ac2ae8c69cfb0753abda581357306/app/controllers/highlight_js_controller.rb#L11


      
          # frozen_string_literal: true
          
          class HighlightJsController < ApplicationController
            skip_before_action :preload_json,
                               :redirect_to_login_if_required,
                               :redirect_to_profile_if_required,
                               :check_xhr,
                               :verify_authenticity_token,
                               only: [:show]
          
            before_action :apply_cdn_headers, only: [:show]
          
            def show
              no_cookies
          
              RailsMultisite::ConnectionManagement.with_hostname(params[:hostname]) do
                current_version = HighlightJs.version(SiteSetting.highlighted_languages)
          
                return redirect_to path(HighlightJs.path) if current_version != params[:version]
          
                # note, this can be slightly optimised by caching the bundled file, it cuts down on N reads

However, those headers are only applied if the request is a “CDN request”:

github.com

discourse/discourse/blob/27c20eeacd0ac2ae8c69cfb0753abda581357306/app/controllers/application_controller.rb#L789


      
            return unless mini_profiler_enabled?
            Rack::MiniProfiler.authorize_request
          end
          
          def check_xhr
            # bypass xhr check on PUT / POST / DELETE provided api key is there, otherwise calling api is annoying
            return if !request.get? && (is_api? || is_user_api?)
            raise ApplicationController::RenderEmpty.new if !request.format&.json? && !request.xhr?
          end
          
          def apply_cdn_headers
            if Discourse.is_cdn_request?(request.env, request.method)
              Discourse.apply_cdn_headers(response.headers)
            end
          end
          
          def self.requires_login(arg = {})
            @requires_login_arg = arg
          end
          
          def self.requires_login_arg

github.com

discourse/discourse/blob/27c20eeacd0ac2ae8c69cfb0753abda581357306/lib/discourse.rb#L1187


      
          end
          
          mattr_accessor :redis
          
          def self.is_parallel_test?
            ENV["RAILS_ENV"] == "test" && ENV["TEST_ENV_NUMBER"]
          end
          
          CDN_REQUEST_METHODS ||= %w[GET HEAD OPTIONS]
          
          def self.is_cdn_request?(env, request_method)
            return if CDN_REQUEST_METHODS.exclude?(request_method)
          
            cdn_hostnames = GlobalSetting.cdn_hostnames
            return if cdn_hostnames.blank?
          
            requested_hostname = env[REQUESTED_HOSTNAME] || env[Rack::HTTP_HOST]
            cdn_hostnames.include?(requested_hostname)
          end
          
          def self.apply_cdn_headers(headers)

This only works if Discourse is configured with a separate host name for “CDN requests”.

simonk · October 28, 2024, 12:02pm

There is a setting, cdn_origin_hostname, which could perhaps be set to the normal discourse host name:

github.com

discourse/discourse/blob/27c20eeacd0ac2ae8c69cfb0753abda581357306/app/models/global_setting.rb#L125


      
          end
          
          # for testing
          def self.reset_s3_cache!
            @use_s3 = nil
          end
          
          def self.cdn_hostnames
            hostnames = []
            hostnames << URI.parse(cdn_url).host if cdn_url.present?
            hostnames << cdn_origin_hostname if cdn_origin_hostname.present?
            hostnames
          end
          
          def self.database_config
            hash = { "adapter" => "postgresql" }
          
            %w[
              pool
              connect_timeout
              socket

github.com

discourse/discourse/blob/27c20eeacd0ac2ae8c69cfb0753abda581357306/config/discourse_defaults.conf#L129


      
          
          # authorization key that will be included as a header in requests made by the
          # snapshots transporter to the URL specified above. The destination should
          # know this key and only accept requests that have this key in the
          # `Mini-Profiler-Transport-Auth` header.
          mini_profiler_snapshots_transport_auth_key =
          
          # recommended, cdn used to access assets
          cdn_url =
          
          # The hostname used by the CDN to request assets
          cdn_origin_hostname =
          
          # comma delimited list of emails that have developer level access
          developer_emails =
          
          # redis server address
          redis_host = localhost
          
          # redis server port
          redis_port = 6379

I think this would cause the is_cdn_request check to pass, but I don’t know if it would have any negative side-effects.

Yt.w · October 28, 2024, 12:48pm

Yes, I am using a CDN on efg.com, but when I access the js file it do return me a correct Access-Control-Allow-Origin, that quite confused me

simonk · October 29, 2024, 5:48pm

As a follow up, I set cdn_origin_hostname to the normal domain name of my Discourse instance, flushed the CDN cache, and now highlightjs is working again. I haven’t noticed any side effects…

Topic		Replies	Views
Migration failed: relation "user_required_fields_versions" already exists Installation unsupported-install	19	128	September 9, 2024
HTTPS works perfectly, but HTTP URL displays NGINX welcome page and doesn't redirect Installation	12	1809	September 18, 2024
After Discourse installation can’t reach it in browser Installation	24	3778	September 5, 2020
Can't get Discourse to work on different ports Installation	2	1425	March 9, 2021
Full site CDN acceleration for Discourse Self-Hosting cdn , explanation	36	18294	September 6, 2023

Issue with Relative Path Causing CORS Error on Discourse Sites

Related topics