Qwik + discord activity + threejs (texture loading), Content Privacy Policy

[smoky salmon]

Hi, i started working on my own activity on discord and i came across a cors error not allowing me to load textures from public directory (due to discord proxy CORS).

i tried out some things but i can't work around its cors and i keep getting this error, im new to CORS and i dont really understood what i was doing. Has anybody worked with discord activities already and can help me with this one? (root is killus.site and textures are downloaded through killus.site/texture, when i open website on website it works fine)

[distant spoke]

Are you also seeing a CORS issue or just CSP?

(The English translation of the error message might be helpful)

Seems like the most likely thing is that if discord is proxying the initial page load, they're also rewriting csp headers.

Something I would suggest is checking if normal <img> tags load, either using relative paths or fully specified urls, to exclude the possibility that threejs is doing something weird.

[smoky salmon]

right now its only CSP, and i can't do relative path bc it forces me to use http request bc its run on a server

[distant spoke]

You can't send an <img src=test.png /> in the response and see what happens? Even a 404 would tell you information.

[smoky salmon]

give me a sec

it loaded through <img> tag with relative path

wait

and when i replaced it with http to my site it was blocked like with texture loader

[smoky salmon]

oh and english translation is just that web settings blocked incoming resource, CPP

[distant spoke]

Ok have you tried using relative paths for the threejs textures?

[smoky salmon]

yes but they are doing it relative to url so './texture' would just give me "https://killus.site/texture/stone.png" for example instead of actual local path

[distant spoke]

Is that because it's pulling in the origin when it generates the final url?

(at build time)

[smoky salmon]

i guess yes if i understand correctly

[distant spoke]

Are the images in the public folder or having their paths imported?

[smoky salmon]

they're in public folder and i get them by passing https url to load function

also i can set header to this loader if that helps with anything

[distant spoke]

What does the code look like when you call load()?

[distant spoke]

Try ./texture there and it'll probably work

[smoky salmon]

i hate cors

i hate cors

i hate cors

i hate cors

i hate cors

i hate cors

[smoky salmon]

thanks for help

i didnt think of it

[distant spoke]

Sorry /texture would be more correct. Happy to help though

[glass snow]

@smoky salmon @distant spoke did y'all figure it out?