Whitelist Campus-Flutter Web App for CORS

[jakobkoerber]

Because of the current CORS protection we currently have to use a proxy server to ensure proper testing of the beta web app. Because this is not a good practice it would be great if the Backend could whitelist web.tum.app to ensure proper loading of endpoints and images. Thank you!

[CommanderStorm]

I have not tested that this works, but given what had to be configured, I don't see where it would not => closed this issue

[jakobkoerber]

Thank you for helping @CommanderStorm! Unfortunately I still experience CORS error in 0.3.0 :/ or is that something I need to fix on the client side?

[CommanderStorm]

I have removed all cors-protection by whitelisting any domain to do cors-request (see c2cf614).

Found this site and testing seems promising ^^

[jakobkoerber]

Thanks again @CommanderStorm! I hope this is not a security issue :D

I still experience CORS errors for the images of the news entries. But I am not sure if we can influence that

[joschahenningsen]

We should actually already scrape the images and host them ourselves. I wonder if we have an issue with that currently 🤔

[joschahenningsen]

https://github.com/TUM-Dev/Campus-Backend/blob/c2cf61443b7003a616db9d50d3755d9242092a95/server/backend/cron/news.go#L121C18-L121C18 We're downloading the file but save the link to the source image in the database it seems

[CommanderStorm]

Actually, we are already serving images: #256
Have I missed changing an API?

[jakobkoerber]

This works in theory but the news recently have https://api.tum.app/files/news/sources/src_1.png set as imageUrl, which is always the TUM logo. That's why I use link as a fallback, which provides the link to the source image

[CommanderStorm]

cannot reproduce for news

Have looked at the sources:
Yes, two of the sources had the TUM logo even though they are only vaguely connected to tum
=> adding these two icons:

[jakobkoerber]

cannot reproduce for news

@CommanderStorm Please take a look at a request like https://api.tum.app/v1/news/-1?oldestDateAt=2023-09-12T20%3A17%3A46.384Z, every news entry has https://api.tum.app/files/news/sources/src_1.png for imageUrl despite having an image provided via link. This seems to be a recent bug. I check for that and fallback to link since displaying the TUM logo doesn't make sense. This introduces the CORS errors on the web app

[CommanderStorm]

I have fixed the entries pointing to this.
Please use the ...Url fields for getting the image and don't use the link property for images.
Link is only where clicking on said news entry should redirect.

[jakobkoerber]

Thank you @CommanderStorm! I used link as a fallback :D CORS works now properly, I currently get a 404 for a lot of the most recent news, seems to be the case especially since mid of September. Any idea why?

[CommanderStorm]

For some news providers (f.ex. newsspread), if we did not catch the images in time, they are gone.
The image URL should only be filled if it is download properly.
Am going to finish up another pr and get to this afterwards