jake-low created an issue (openstreetmap/openstreetmap-website#7185)
### Problem
The avatar URL in `/api/0.6/user/:id` can't be resolved or cached from browser
JS because the S3 redirect target lacks permissive CORS headers.
### Description
Currently, the user info endpoint (example:
https://www.openstreetmap.org/api/0.6/user/8794039.json) returns an `.img.href`
property pointing to the user's avatar. The immediate URL target is a Rails
activestorage URL such as this:
```
https://www.openstreetmap.org/rails/active_storage/representations/redirect/eyJfcmFpbHMiOnsiZGF0YSI6MzM3MjY1NTQsInB1ciI6ImJsb2JfaWQifX0=--4aadb4cda4a2611cd615348ac17fb629365e82bb/eyJfcmFpbHMiOnsiZGF0YSI6eyJmb3JtYXQiOiJqcGciLCJyZXNpemVfdG9fbGltaXQiOlsxMDAsMTAwXX0sInB1ciI6InZhcmlhdGlvbiJ9fQ==--71e417a328c02e35ec87b6c7cd4e4524c74e4ec8/profile-picture.jpg
```
Those URLs then redirect to static object URLs in S3, e.g.:
```
https://openstreetmap-user-avatars.s3.dualstack.eu-west-1.amazonaws.com/gxq2fdrjud8ehql1e770pyqm2iud
```
When developing third-party applications that show OSM user profiles, it seems
like a good idea to resolve the redirects up front and cache them, both to
improve latency when loading the images again later, and to avoid making
unnecessary requests on the Rails backend. This is easy to do in server or
mobile apps, but in browser JavaScript code, the lack of a CORS
`Access-Control-Allow-Origin: *` header on the final S3 URL response means the
browser prevents the JS code from resolving the URL or loading the image.
You can still load profile images in third party websites via `<img src>` or
similar, which is how most apps I'm familiar with work (MapRoulette and OSMCha
for example). But this means that each page load hits the Rails endpoint first
to resolve the redirect. And if an app wanted to display a list of many users
with profile pictures, it would create a burst of requests, multiplying any
problems created both for end users (longer latency to load images) and for the
openstreetmap.org website (more load on the Rails backend).
Note: this would be an ops/configuration change, not a code change in the Rails
code; let me know if there's a better place to open such issues in the future.
### Screenshots
_No response_
--
Reply to this email directly or view it on GitHub:
https://github.com/openstreetmap/openstreetmap-website/issues/7185
You are receiving this because you are subscribed to this thread.
Message ID: <openstreetmap/openstreetmap-website/issues/[email protected]>
_______________________________________________
rails-dev mailing list
[email protected]
https://lists.openstreetmap.org/listinfo/rails-dev
