# I am the Watcher. I am your guide through this vast new twtiverse.
# 
# Usage:
#     https://watcher.sour.is/api/plain/users              View list of users and latest twt date.
#     https://watcher.sour.is/api/plain/twt                View all twts.
#     https://watcher.sour.is/api/plain/mentions?uri=:uri  View all mentions for uri.
#     https://watcher.sour.is/api/plain/conv/:hash         View all twts for a conversation subject.
# 
# Options:
#     uri     Filter to show a specific users twts.
#     offset  Start index for quey.
#     limit   Count of items to return (going back in time).
# 
# twt range = 1 11
# self = https://watcher.sour.is/conv/ao7rsoq
akoizumi
social.kyoko-project.wer.ee
View Thread
@prologic what Content-Security-Policy should I have on my web server for salty? the frontend ain't reacting well to my global config lol

>>
evalerror: refused to create a webassembly object because 'unsafe-eval' is not an allowed source of script in the following content security policy directive: "default-src 'self'".
<<
prologic
twtxt.net
View Thread
@akoizumi Oh dear 😅 I'm not actually really sure 🤔 @xuu Any clues? 🤔
prologic
twtxt.net
View Thread
@akoizumi Oh dear 😅 I'm not actually really sure 🤔 @xuu Any clues? 🤔
prologic
twtxt.net
View Thread
@akoizumi Oh?! This is to run/access the PWA? 🤔
prologic
twtxt.net
View Thread
@akoizumi Oh?! This is to run/access the PWA? 🤔
akoizumi
social.kyoko-project.wer.ee
View Thread
@prologic yeah just the PWA, the non-web client(s) work just fine
prologic
twtxt.net
View Thread
@akoizumi I _feel_ stupid right now, we don't actually set any specific CSP headers at all, only Access-Control-* ones:


$ sift -x go Headers
internal/server.go:160:\t\t\t\t\tRemoteAddressHeaders: []string{"X-Forwarded-For"},
internal/server.go:313:\t\tRawHeaders: []string{
internal/server.go:380:\t\t\tw.Header().Set("Access-Control-Allow-Headers", "*")
internal/server.go:381:\t\t\tw.Header().Set("Access-Control-Expose-Headers", "*")
internal/server.go:404:\t\t\t\tRemoteAddressHeaders: []string{"X-Forwarded-For"},
internal/router.go:32:\t\t\t\tw.Header().Set("Access-Control-Allow-Headers", "*")
internal/router.go:33:\t\t\t\tw.Header().Set("Access-Control-Expose-Headers", "*")
prologic
twtxt.net
View Thread
@akoizumi I _feel_ stupid right now, we don't actually set any specific CSP headers at all, only Access-Control-* ones:


$ sift -x go Headers
internal/server.go:160:					RemoteAddressHeaders: []string{"X-Forwarded-For"},
internal/server.go:313:		RawHeaders: []string{
internal/server.go:380:			w.Header().Set("Access-Control-Allow-Headers", "*")
internal/server.go:381:			w.Header().Set("Access-Control-Expose-Headers", "*")
internal/server.go:404:				RemoteAddressHeaders: []string{"X-Forwarded-For"},
internal/router.go:32:				w.Header().Set("Access-Control-Allow-Headers", "*")
internal/router.go:33:				w.Header().Set("Access-Control-Expose-Headers", "*")
prologic
twtxt.net
View Thread
@akoizumi I _feel_ stupid right now, we don't actually set any specific CSP headers at all, only Access-Control-* ones:


$ sift -x go Headers
internal/server.go:160:					RemoteAddressHeaders: []string{"X-Forwarded-For"},
internal/server.go:313:		RawHeaders: []string{
internal/server.go:380:			w.Header().Set("Access-Control-Allow-Headers", "*")
internal/server.go:381:			w.Header().Set("Access-Control-Expose-Headers", "*")
internal/server.go:404:				RemoteAddressHeaders: []string{"X-Forwarded-For"},
internal/router.go:32:				w.Header().Set("Access-Control-Allow-Headers", "*")
internal/router.go:33:				w.Header().Set("Access-Control-Expose-Headers", "*")
xuu@dev.txt.sour.is
dev.txt.sour.is
View Thread
oh wow.. no clue. maybe a config issue where its loading the webassm from a different domain? https vs http even?
xuu
txt.sour.is
View Thread
oh wow.. no clue. maybe a config issue where its loading the webassm from a different domain? https vs http even?