Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

inlineImages: Setting of image.crossOrigin is not always necessary #1468

Merged
merged 13 commits into from
May 23, 2024

Conversation

eoghanmurray
Copy link
Contributor

Setting of image.crossOrigin is not necessary for same origin images, and causes an immediate image reload necessitating the load event listener (albeit from cache)

Changeset:
"inlineImages: during snapshot avoid adding an event listener for inlining of same-origin images (async listener mutates the snapshot which can be problematic)"

Copy link

changeset-bot bot commented May 3, 2024

🦋 Changeset detected

Latest commit: ba7ca2d

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 8 packages
Name Type
rrweb Patch
rrweb-snapshot Patch
rrdom Patch
rrdom-nodejs Patch
rrweb-player Patch
@rrweb/types Patch
@rrweb/web-extension Patch
rrvideo Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@eoghanmurray eoghanmurray changed the title inlineImags: Setting of image.crossOrigin is not always necessary inlineImages: Setting of image.crossOrigin is not always necessary May 3, 2024
@croqaz
Copy link
Contributor

croqaz commented May 7, 2024

Hi, thanks for the PR! I didn't use this project anymore, so I won't test the code on my own.
But I understand the problem you're trying to solve and I can confirm that setting the crossOrigin triggers a browser request.
This fix looks great!
I would test it with some pages that have images stored in a CDN which is different than the website host, from what I remember this is what triggers the crossOrigin request. This would be just to make sure the feature is not broken. You could make a static HTML page and inject some random images from random domains and record that page to see that it works.

@eoghanmurray
Copy link
Contributor Author

I would test it with some pages that have images stored in a CDN which is different than the website host, from what I remember this is what triggers the crossOrigin request. This would be just to make sure the feature is not broken.

Thank you so much for suggesting this; in fact the new code had a bug not present in the prior version which I've fixed here: 236cd54

@eoghanmurray eoghanmurray requested a review from Yuyz0112 May 8, 2024 15:41
<source type="image/webp" srcset="assets/img/characters/robot.webp" />
<img src="assets/img/characters/robot.png" />
</picture>
<img src="/images/robot.png" alt="This is a robot" />
<img src="https://avatars.githubusercontent.com/u/43396833?s=20&v=4" alt="CORS restricted but has access-control-allow-origin: *" />
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was also thinking of using https://www.rrweb.io/favicon.png here but that isn't served with the requisite access-control-allow-origin: *@Yuyz0112 if you wish to add that header I can update the test to point to our own resource

Copy link
Contributor

@Juice10 Juice10 May 22, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You could also check out how we do cross origin tests and do it in a similar fashion:

<iframe src="{SERVER_URL}/html/form.html" style="width: 400px; height: 400px;"></iframe>

This uses {SERVER_URL} to which gets replaced with a locally hosted server, and since about:blank is a different origin than that server you get your cross origin image

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ah that's good

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll check if I can get our test server to set the access-control headers.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's done in d2df9bb
I can't believe it but it worked first time.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I didn't explicitly set or check that the access-control-origin header is actually being set; but I verified that failing to set the crossorigin="anonymous" on the <img> causes the test to fail

@eoghanmurray eoghanmurray merged commit 4014305 into rrweb-io:master May 23, 2024
6 checks passed
Juice10 pushed a commit that referenced this pull request May 28, 2024
…1468)

Setting of the `crossorigin` attribute is not necessary for same-origin images, and causes an immediate image reload (albeit from cache) necessitating the use of a load event listener which subsequently mutates the snapshot.  This change allows us to  avoid the mutation of the snapshot for the same-origin case.

* Modify inlineImages test to remove delay and show that we can inline images without mutation

* Add an explicit test for when the `image.crossOrigin = 'anonymous';` method is necessary.  Uses a combination of about:blank and our test server to simulate a cross-origin context

* Other test changes: there were some spurious rrweb mutations being generated by the addition of the crossorigin attribute that are now elimnated from the rrweb/__snapshots__/integration.test.ts.snap after this PR - this is good
Juice10 pushed a commit that referenced this pull request May 28, 2024
…1468)

Setting of the `crossorigin` attribute is not necessary for same-origin images, and causes an immediate image reload (albeit from cache) necessitating the use of a load event listener which subsequently mutates the snapshot.  This change allows us to  avoid the mutation of the snapshot for the same-origin case.

* Modify inlineImages test to remove delay and show that we can inline images without mutation

* Add an explicit test for when the `image.crossOrigin = 'anonymous';` method is necessary.  Uses a combination of about:blank and our test server to simulate a cross-origin context

* Other test changes: there were some spurious rrweb mutations being generated by the addition of the crossorigin attribute that are now elimnated from the rrweb/__snapshots__/integration.test.ts.snap after this PR - this is good
Juice10 pushed a commit that referenced this pull request May 28, 2024
…1468)

Setting of the `crossorigin` attribute is not necessary for same-origin images, and causes an immediate image reload (albeit from cache) necessitating the use of a load event listener which subsequently mutates the snapshot.  This change allows us to  avoid the mutation of the snapshot for the same-origin case.

* Modify inlineImages test to remove delay and show that we can inline images without mutation

* Add an explicit test for when the `image.crossOrigin = 'anonymous';` method is necessary.  Uses a combination of about:blank and our test server to simulate a cross-origin context

* Other test changes: there were some spurious rrweb mutations being generated by the addition of the crossorigin attribute that are now elimnated from the rrweb/__snapshots__/integration.test.ts.snap after this PR - this is good
vincent-psarga added a commit to Smartesting/rrweb that referenced this pull request Jun 5, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants