Codeberg/Community
54
325
Fork
You've already forked Community
12

CORS for packages #2144

Open
opened 2025年09月22日 10:32:34 +02:00 by chrysn · 3 comments

Comment

When packages are hosted in public Codeberg organizations, they are generally accessible, but not from web browsers (which'd require CORS).

Practical use cases for this are all situations when JupyterLite notebooks install packages from a repository: In those cases, Python (or Ruby or R) are running inside a browser's WASM engine. For example, aiocoap uses this in its documentation to enable users to explore the library without any installation. As a workaround, I'm manually mirroring its packages to an own server with fuller CORS control.

Please consider activating CORS at least for the generated indices and the packages themselves. As I understand discussion on Forgejo enabling this, it already has the right knobs (although I'm not sure if their granularity suffices).

Security implications

As I understand, the basic CORS setting (Access-Control-Allow-Origin: *) will only allow browsers to send requests that don't send access control headers, so no special considerations are needed for private package repos (if that's even a thing on Codeberg). This would be a problem if Codeberg operated under the assumption that certain IP addresses are privileged to see some information, but Codeberg being a public service, I don't think that's the case.

Crawling implications

Only hypothetical implications: If Codeberg does block certain IP ranges from accessing packages (as AIU it is done during the current bursts bot activity), the crawlers could commandeer people's browsers and make them download on their behalf, turning crawling into a distributed thing. However, that'd require the bot operators to lure users onto their own pages – and those own pages then still do show up in "Origin:" headers sent by the browser, so they could be blocked that way.

### Comment When packages are hosted in public Codeberg organizations, they are generally accessible, but not from web browsers (which'd require CORS). Practical use cases for this are all situations when [JupyterLite notebooks](https://jupyter.org/try) install packages from a repository: In those cases, Python (or Ruby or R) are running inside a browser's WASM engine. For example, aiocoap uses this [in its documentation](https://aiocoap.readthedocs.io/en/latest/pyodide.html) to enable users to explore the library without any installation. As a workaround, I'm manually mirroring [its packages](https://codeberg.org/aiocoap/-/packages) to an own server with fuller CORS control. Please consider activating CORS at least for the generated indices and the packages themselves. As I understand [discussion on Forgejo enabling this](https://codeberg.org/forgejo/forgejo/issues/9361#issuecomment-7272049), it already has the right knobs (although I'm not sure if their granularity suffices). ## Security implications As I understand, the basic CORS setting (`Access-Control-Allow-Origin: *`) will only allow browsers to send requests that *don't* send access control headers, so no special considerations are needed for private package repos (if that's even a thing on Codeberg). This *would* be a problem if Codeberg operated under the assumption that certain IP addresses are privileged to see some information, but Codeberg being a public service, I don't think that's the case. ## Crawling implications Only hypothetical implications: If Codeberg does block certain IP ranges from accessing packages (as AIU it is done during the current bursts bot activity), the crawlers could commandeer people's browsers and make *them* download on their behalf, turning crawling into a distributed thing. However, that'd require the bot operators to lure users onto their own pages – and those own pages then still do show up in "Origin:" headers sent by the browser, so they could be blocked that way.

@chrysn wrote in #2144 (comment):

Please consider activating CORS at least for the generated indices and the packages themselves. As I understand discussion on Forgejo enabling this, it already has the right knobs (although I'm not sure if their granularity suffices).

No, there is no feature in Forgejo that would enable CORS for the package routes. CORS is otherwise already enabled:

The comment refers to adding it to Codeberg's reverse proxy setup to add this CORS, which is not something we would like to do. It should be implemented in Forgejo, adding CORS support for some route in a reverse proxy is not that trivial.

@chrysn wrote in #2144 (comment):

Only hypothetical implications: If Codeberg does block certain IP ranges from accessing packages (as AIU it is done during the current bursts bot activity), the crawlers could commandeer people's browsers and make them download on their behalf, turning crawling into a distributed thing. However, that'd require the bot operators to lure users onto their own pages – and those own pages then still do show up in "Origin:" headers sent by the browser, so they could be blocked that way.

We already have CORS enabled for the general API, so that shouldn't be too much of a new implication.

@chrysn wrote in https://codeberg.org/Codeberg/Community/issues/2144#issue-2413360: > Please consider activating CORS at least for the generated indices and the packages themselves. As I understand [discussion on Forgejo enabling this](https://codeberg.org/forgejo/forgejo/issues/9361#issuecomment-7272049), it already has the right knobs (although I'm not sure if their granularity suffices). No, there is no feature in Forgejo that would enable CORS for the package routes. CORS is otherwise already enabled: https://codeberg.org/Codeberg-Infrastructure/build-deploy-forgejo/src/commit/747d8b7c22db487a001e42642ba31c02a74747fb/etc/forgejo/conf/base.ini#L186-L188 The comment refers to adding it to Codeberg's reverse proxy setup to add this CORS, which is not something we would like to do. It should be implemented in Forgejo, adding CORS support for some route in a reverse proxy is not that trivial. @chrysn wrote in https://codeberg.org/Codeberg/Community/issues/2144#issue-2413360: > Only hypothetical implications: If Codeberg does block certain IP ranges from accessing packages (as AIU it is done during the current bursts bot activity), the crawlers could commandeer people's browsers and make _them_ download on their behalf, turning crawling into a distributed thing. However, that'd require the bot operators to lure users onto their own pages – and those own pages then still do show up in "Origin:" headers sent by the browser, so they could be blocked that way. We already have CORS enabled for the general API, so that shouldn't be too much of a new implication.
Author
Copy link

Thanks. I'll see with that what I can do in the Forgejo issue; I'd welcome you to join me there to avoid the Telephone Game if you can spare the mindshare for it (but hope to get it moving from the feedback you already provided).

Thanks. I'll see with that what I can do in [the Forgejo issue](https://codeberg.org/forgejo/forgejo/issues/9361); I'd welcome you to join me there to avoid the Telephone Game if you can spare the mindshare for it (but hope to get it moving from the feedback you already provided).

Hi, I'm new to Codeberg and stumbled across this topic when trying to solve a CORS error.
When searching for other solutions, I found this topic with a reference to the docs which explain you can use the raw URLs (https://raw.codeberg.page/username/reponame/) that are accessible with CORS.
Maybe this can solve your problem?

Hi, I'm new to Codeberg and stumbled across this topic when trying to solve a CORS error. When searching for other solutions, I found [this topic](https://codeberg.org/Codeberg/Community/issues/1949#issuecomment-4851351) with a reference to [the docs](https://docs.codeberg.org/codeberg-pages/#advanced-usage%3A-canonical-urls) which explain you can use the raw URLs ([https://raw.codeberg.page/username/reponame/](https://raw.codeberg.page/username/reponame/)) that are accessible with CORS. Maybe this can solve your problem?
Sign in to join this conversation.
No Branch/Tag specified
main
No results found.
Labels
Clear labels
accessibility

Reduces accessibility and is thus a "bug" for certain user groups on Codeberg.
bug

Something is not working the way it should. Does not concern outages.
bug
infrastructure

Errors evidently caused by infrastructure malfunctions or outages
Codeberg

This issue involves Codeberg's downstream modifications and settings and/or Codeberg's structures.
contributions welcome

Please join the discussion and consider contributing a PR!
docs

No bug, but an improvement to the docs or UI description will help
duplicate

This issue or pull request already exists
enhancement

New feature
infrastructure

Involves changes to the server setups, use `bug/infrastructure` for infrastructure-related user errors.
legal

An issue directly involving legal compliance
licence / ToS

involving questions about the ToS, especially licencing compliance
please chill
we are volunteers

Please consider editing your posts and remember that there is a human on the other side. We get that you are frustrated, but it's harder for us to help you this way.
public relations

Things related to Codeberg's external communication
question

More information is needed
question
user support

This issue contains a clearly stated problem. However, it is not clear whether we have to fix anything on Codeberg's end, but we're helping them fix it and/or find the cause.
s/Forgejo

Related to Forgejo. Please also check Forgejo's issue tracker.
s/Forgejo/migration

Migration related issues in Forgejo
s/Pages

Issues related to the Codeberg Pages feature
s/Weblate

Issue is related to the Weblate instance at https://translate.codeberg.org
s/Woodpecker

Woodpecker CI related issue
security

involves improvements to the sites security
service

Add a new service to the Codeberg ecosystem (instead of implementing into Gitea)
upstream

An open issue or pull request to an upstream repository to fix this issue (partially or completely) exists (i.e. Gitea, Forgejo, etc.)
wontfix

Codeberg's current set of contributors are not planning to spend time on delegating this issue.
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
3 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Codeberg/Community#2144
Reference in a new issue
Codeberg/Community
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?