• AnarchoYeasty@beehaw.org
    link
    fedilink
    English
    arrow-up
    9
    ·
    edit-2
    1 year ago

    Web front ends currently require a backend service that then routes to your intended destination because Lemmy servers by default are configured with cors to only allow requests from their intended domain. There is a PR to fix it but I don’t believe it’s been merged in. This may be out of date but that was true as of a few weeks ago per the dev of Voyager which is the web frontend I use

    edit: this is no longer true. A PR 2 weeks ago fixed this issue and web front ends are able to work just as well as a native app now.

    • aserraric@discuss.tchncs.de
      link
      fedilink
      English
      arrow-up
      8
      ·
      1 year ago

      I’ve looked at the traffic, and all calls go directly to the API of my instance. I don’t think Alexandrite even runs a backend.

    • CuriousGoo@beehaw.org
      link
      fedilink
      English
      arrow-up
      8
      ·
      edit-2
      1 year ago

      I see, but how is this different in a phone app? Wouldn’t the request still be made to a backend?

      • AnarchoYeasty@beehaw.org
        link
        fedilink
        English
        arrow-up
        5
        ·
        1 year ago

        1.) Turns out this is no longer true because the cors issue is fixed as of two weeks ago.

        But to answer your question:

        Well that’s the really silly part about it. You see, the way CORS works is that it only works if the client making the request implements cors. In this case when I say client I’m talking about your web browser itself. Native applications, or hitting an API directly via network calls, don’t implement cors and thus you can make the calls all you want and the server responds. So even when cors was configured to only allow requests from the correct domain it only affected people with web browsers.

        However two weeks ago a PR was merged into the Lemmy source code setting the cors to by default allow requests from anyone instead of a specific domain.