module

relay

Sources the browser isn't allowed to read.

A browser only lets a page read another site's answer when that site says so, with an Access-Control-Allow-Origin header (CORS). Many data publishers don't send one. A src or load pointing at such a site is fetched through the app's relay route instead (PATH, served by weft_api::relay): the page asks its own server, and the server asks the site.

The relay only forwards to the origins the app's templates name, so it can't be used to reach anywhere else.

The build learns which origins need it: when it fetches a remote source, it checks for the header and the page carries the origins that lack it (ID). The browser also falls back to the relay when a direct fetch fails, and remembers the origin for the rest of the visit.

Functions

allows

pub fn allows(url: &str, allowed: &[&str]) -> bool

Whether the relay may forward to url: an http/https URL on one of allowed (origins, as origin writes them).

allows_cors

pub fn allows_cors(res: &Response) -> bool

Whether a response lets other sites' pages read it.

available

pub fn available() -> bool

Whether the relay may be there: true until an answer shows it isn't.

first_check

pub fn first_check(origin: &str) -> bool

Whether the build still has to check origin (true once per origin).

mark_unavailable

pub fn mark_unavailable()

Note that this site has no relay (its answer lacked MARKER).

may_relay

pub fn may_relay(req: &Request) -> bool

Whether req is one the relay could send: a GET to another site.

needed

pub fn needed(url: &str) -> bool

Whether url's origin is known to need the relay.

note

pub fn note(origin: &str)

Note that origin doesn't let browsers read it.

origin

pub fn origin(url: &str) -> Option<String>

scheme://host[:port] of an http or https URL, lower-cased. None for anything else, including URLs with a user name or password.

origins

pub fn origins() -> Vec<String>

The origins known to need the relay.

reset

pub fn reset()

Forget everything noted (for tests).

set_origins

pub fn set_origins<I: IntoIterator<Item = String>>(origins: I)

Set the origins known to need the relay (what the page carries).

set_origins_json

pub fn set_origins_json(j: &Value)

Read what the page carries (the JSON of ID's element).

url_for

pub fn url_for(target: &str) -> String

The relay's URL for target.

Constants

CHECK_ORIGIN

pub const CHECK_ORIGIN: &str = "https://weft.invalid";

The Origin the build checks with. Sites that allow every origin echo it back or answer *; sites that allow none answer nothing.

ID

pub const ID: &str = "weft-relay";

The id of the script element carrying the origins that need the relay.

MARKER

pub const MARKER: &str = "x-weft-relay";

The header the relay adds to its answers, so the browser can tell them from a site with no relay (whose fallback page might answer 200).

PATH

pub const PATH: &str = "/api/weft-relay";

Where the app serves the relay.