Skip to content

fix: prevent cookie transfers during external data loads #15504

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
May 28, 2025
Merged

fix: prevent cookie transfers during external data loads #15504

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0212a9a
fix: prevent cookie transfer during xml fetches
wackerow May 23, 2025
34e9ea2
fix: no-referrer anonymous img loads
wackerow May 26, 2025
2732417
fix: use internally hosted image
wackerow May 26, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions app/[locale]/_components/home.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -651,6 +651,8 @@ const HomePage = ({
e.currentTarget.onerror = null
e.currentTarget.src = EventFallback.src
}}
referrerPolicy="no-referrer"
crossOrigin="anonymous"
/>
</CardBanner>
<CardContent>
Expand Down Expand Up @@ -738,6 +740,8 @@ const HomePage = ({
}}
className="max-w-full object-cover object-center"
loading="lazy"
referrerPolicy="no-referrer"
crossOrigin="anonymous"
/>
) : (
<Image src={EventFallback} alt="" />
Expand Down
11 changes: 2 additions & 9 deletions public/content/developers/tutorials/the-graph-fixing-web3-data-querying/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,14 +3,7 @@ title: "The Graph: Fixing Web3 data querying"
description: Blockchain is like a database but without SQL. All the data is there, but no way to access it. Let me show you how to fix this with The Graph and GraphQL.
author: Markus Waas
lang: en
tags:
[
"solidity",
"smart contracts",
"querying",
"the graph",
"react",
]
tags: ["solidity", "smart contracts", "querying", "the graph", "react"]
skill: intermediate
published: 2020-09-06
source: soliditydeveloper.com
Expand Down Expand Up @@ -90,7 +83,7 @@ First let's talk about GraphQL, originally designed and implemented by Facebook.

![GraphQL API vs. REST API](./graphql.jpg)

<img src="https://cdn0.scrvt.com/b095ee27d37b3d7b6b150adba9ac6ec8/42226f4816a77656/bc5c8b270798/graphql-querygif.gif" width="100%"/>
![](./graphql-query.gif)

The two images pretty much capture the essence of GraphQL. With the query on the right we can define exactly what data we want, so there we get everything in one request and nothing more than exactly what we need. A GraphQL server handles the fetching of all data required, so it is incredibly easy for the frontend consumer side to use. [This is a nice explanation](https://www.apollographql.com/blog/graphql-explained-5844742f195e/) of how exactly the server handles a query if you're interested.

Expand Down
4 changes: 4 additions & 0 deletions ...a/placeholders/content-developers-tutorials-the-graph-fixing-web3-data-querying-data.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,5 +22,9 @@
"/content/developers/tutorials/the-graph-fixing-web3-data-querying/thegraph-explorer.png": {
"hash": "48f6c069",
"base64": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAALCAIAAAD5gJpuAAAACXBIWXMAAAPoAAAD6AG1e1JrAAACJklEQVR4nAEbAuT9ABYRIRYQIhMPHRYTJA8RJwcIHwMCGAgGGwQDFwIBFAAAEwUEGAUEGAAAFAkIGw4NHwASM2EXOWwXN3ATLFxFPUZYUFNYUFNAOUNLSlpjX21oXnFJR1ZKQ1ZeWGlgVmhKQVQAP3fcSYf3S4b+M2O8rZp9u6aCvKeEno17087V7//31frsyMTIx667/8rg/9Hjxa25ADNmuD96yjx6zSdVmYl6ZX9yWG1fR3NoW6uor3G/o0G1jJWjpKqKn9KIp9Rckad8lAA2W4pCZpQpWIoXP2lhV055bl1cUT5JPDh6goVZn4ZooIt3fH6EX3WthpWhZH14UGgAGB1IKy5YJCpTEBc9LCwuLzczLTozKiovQTxJTE5RQkRINzFASkRPYFBZVEtOQjhGACd8Vi6LXDCPXR5lT0ooPZlDSpMmR0cbQYKBk6edqqWbqId/kEpBXjEiQTQlQ1NFYABT3nJh/Xpl/4BBt2nGXUr/eVf/glG8UlS9ub1zb2h9e3O/u76jlKZkn5JymY+llKUAO6ldQLRhQrddLYpQqnx2u2KByGdIqlVUTUlTFxcWGBgVUUxUQ0JWM5RyMHxcNi1CAC1+UESWYSl/PhlaOH9xbZ51cY1WZmIlNmRjaD88OSQjH09ITy4tPTpdUR08MBURIAARPi0ZSzQSRy8IListGSFJKiVFJicoFSVCQExHQUZIRUhCPEkaEiUeKy0aICUaECI8o7+y+wRmBAAAAABJRU5ErkJggg=="
},
"/content/developers/tutorials/the-graph-fixing-web3-data-querying/graphql-query.gif": {
"hash": "15d03461",
"base64": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAMCAYAAABr5z2BAAAACXBIWXMAAAPoAAAD6AG1e1JrAAABAklEQVR4nGMwM7f4LyUl9V9SknSsoKj0n8HG2vZ/c3Pz/3nz5v6fOnUK0XjevNn/i4qK/jNMmTL1f2Zm5n8PD4//pIKjR4/9Z+jt7fs/f/78/wkJCf+/fv1KNAaBfXv3/WfIysr6/+DBfZJtR3EBCMBMJdmAoqLi/9evX/t/9uyZ/8ePHft/5MgRovC5c+f+z5wx8z9DT0/P/6XLV4Hx9evX/7979+7/z+8//3/79u3/j+/fCbtg/vwF/7fv3PNfTc/0/9p16/9Pau3531xW+z/Yxfd/aXr+/xfPnhP2wuvXr+GCINvRQxuvAdOmTSct5NANaGlpAwbIBaIDDzkQQd4HAMXFfREF8kXGAAAAAElFTkSuQmCC"
}
}
5 changes: 4 additions & 1 deletion src/lib/api/fetchRSS.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,7 +130,10 @@ export const fetchRSS = async (xmlUrl: string | string[]) => {
*/
export const fetchXml = async (url: string) => {
try {
const response = await fetch(url)
const response = await fetch(url, {
headers: { Cookie: "", DNT: "1" }, // Empty cookie header and do-not-track
credentials: "omit", // Don't send or receive cookies
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

interesting, wonder if we should apply more of this in the other fetches for external data

})
const xml = await response.text()
let returnObject: Record<string, unknown> = {}
parseString(xml, (err, result) => {
Expand Down