Question: Possibility to call XMLHttpRequest from within Mod - Githubissues

spotfiresoftware / spotfire-mods

Spotfire® Mods

https://spotfiresoftware.github.io/spotfire-mods/

Other

56 stars 41 forks source link

Question: Possibility to call XMLHttpRequest from within Mod #79

Closed hski-github closed 2 years ago

hski-github commented 2 years ago

In the Mods manifest you can register external resources. Are these URLs are allowed for XMLHttpRequest calls from within JavaScript code of the Mod? Or is this blocked by the Mods framework?

objerke commented 2 years ago

Yes, you are allowed to make XMLHttpRequest calls to external resources. You can add URLs in the top level property externalResources (string[]) in the mod-manifest.json. This will allow the mod to make Ajax or other kinds of calls to those URLs. This is for example done in the ts-dev-gauge-googlecharts example to reach the google charts library.

There are some areas worth knowing when using external resources from a mod:

A mod's iframe is sandboxed and therefore its origin header is null in any network requests it makes.
Mods with external resources cannot be exported from the web client, due to security concerns.

Why is an external resource not loading correctly due to a content security policy?