Instagram API CORB
My angular app uses https://api.instagram.com/oembed to embed instagram posts, but it receives Cross-Origin Read Blocking (CORB) blocked cross-origin response, though the app uses Jsonp.
The Chrome Console shows that the url is https://api.instagram.com/oembed/?omitscript=true&omit_script=true&callback=ng_jsonp.__req0.finished&maxwidth=800&hidecaption=true&url=https://www.instagram.com/p/BeyU33KF-wQ/
angular instagram instagram-api edited Nov 23 '18 at 16:14
georgeawg
34k115370
asked Nov 22 '18 at 12:58
Yury HomenokYury Homenok
195
add a comment |
My angular app uses https://api.instagram.com/oembed to embed instagram posts, but it receives Cross-Origin Read Blocking (CORB) blocked cross-origin response, though the app uses Jsonp.
The Chrome Console shows that the url is https://api.instagram.com/oembed/?omitscript=true&omit_script=true&callback=ng_jsonp.__req0.finished&maxwidth=800&hidecaption=true&url=https://www.instagram.com/p/BeyU33KF-wQ/
angular instagram instagram-api edited Nov 23 '18 at 16:14
georgeawg
34k115370
asked Nov 22 '18 at 12:58
Yury HomenokYury Homenok
195
http.jsonp is undefined here, but I use import { Jsonp } from '@angular/http'; So, I work through Jsonp.
– Yury Homenok
Nov 23 '18 at 5:54
Though when I use just http (not jsonp) it works.
– Yury Homenok
Nov 23 '18 at 8:14
add a comment |
My angular app uses https://api.instagram.com/oembed to embed instagram posts, but it receives Cross-Origin Read Blocking (CORB) blocked cross-origin response, though the app uses Jsonp.
The Chrome Console shows that the url is https://api.instagram.com/oembed/?omitscript=true&omit_script=true&callback=ng_jsonp.__req0.finished&maxwidth=800&hidecaption=true&url=https://www.instagram.com/p/BeyU33KF-wQ/
angular instagram instagram-api edited Nov 23 '18 at 16:14
georgeawg
34k115370
asked Nov 22 '18 at 12:58
Yury HomenokYury Homenok
195
My angular app uses https://api.instagram.com/oembed to embed instagram posts, but it receives Cross-Origin Read Blocking (CORB) blocked cross-origin response, though the app uses Jsonp.
The Chrome Console shows that the url is https://api.instagram.com/oembed/?omitscript=true&omit_script=true&callback=ng_jsonp.__req0.finished&maxwidth=800&hidecaption=true&url=https://www.instagram.com/p/BeyU33KF-wQ/
angular instagram instagram-api angular instagram instagram-api edited Nov 23 '18 at 16:14
georgeawg
34k115370
asked Nov 22 '18 at 12:58
Yury HomenokYury Homenok
195
edited Nov 23 '18 at 16:14
georgeawg
34k115370
asked Nov 22 '18 at 12:58
Yury HomenokYury Homenok
195
edited Nov 23 '18 at 16:14
georgeawg
34k115370
edited Nov 23 '18 at 16:14
georgeawg
34k115370
edited Nov 23 '18 at 16:14
georgeawg
34k115370
34k115370
asked Nov 22 '18 at 12:58
Yury HomenokYury Homenok
195
asked Nov 22 '18 at 12:58
Yury HomenokYury Homenok
195
asked Nov 22 '18 at 12:58
Yury HomenokYury Homenok
195
195
http.jsonp is undefined here, but I use import { Jsonp } from '@angular/http'; So, I work through Jsonp.
– Yury Homenok
Nov 23 '18 at 5:54
Though when I use just http (not jsonp) it works.
– Yury Homenok
Nov 23 '18 at 8:14
add a comment |
http.jsonp is undefined here, but I use import { Jsonp } from '@angular/http'; So, I work through Jsonp.
– Yury Homenok
Nov 23 '18 at 5:54
Though when I use just http (not jsonp) it works.
– Yury Homenok
Nov 23 '18 at 8:14
http.jsonp is undefined here, but I use import { Jsonp } from '@angular/http'; So, I work through Jsonp.
– Yury Homenok
Nov 23 '18 at 5:54
http.jsonp is undefined here, but I use import { Jsonp } from '@angular/http'; So, I work through Jsonp.
– Yury Homenok
Nov 23 '18 at 5:54
Though when I use just http (not jsonp) it works.
– Yury Homenok
Nov 23 '18 at 8:14
Though when I use just http (not jsonp) it works.
– Yury Homenok
Nov 23 '18 at 8:14
add a comment |
1 Answer
1
active
oldest
votes
JSONp is deprecated in Angular. And there is a pretty rational reason why. JSONp is a request method which was previously used to insert a callback into the response body of the request. You can think of it as a solution predating the wide accepted us of promises and observables in angular.
https://angular.io/api/http/Jsonp
From your example if working JSONp would be executing ng_jsonp.__req0.finished() when the response was received. The problem from an angular perspective is what if I am controlling the api you are requesting from. Well I could 301 your request to a different url with my own callback that contains malicious code.
This is the type of vulnerability that CORB is attempting to solve on behalf of the user.
This is also why the same request works just fine with a standard GET because the callback is simply ignored in favor of the valid JSON.
if you have a specific callback you want to execute after the response comes in I suggest taking a look at RXJS.
(This answer assumes you meant Angular (current) and not AngularJs if you meant angular js you should look into promises)
answered Dec 17 '18 at 2:01
BatoureBatoure
311
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53431576%2finstagram-api-corb%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
JSONp is deprecated in Angular. And there is a pretty rational reason why. JSONp is a request method which was previously used to insert a callback into the response body of the request. You can think of it as a solution predating the wide accepted us of promises and observables in angular.
https://angular.io/api/http/Jsonp
From your example if working JSONp would be executing ng_jsonp.__req0.finished() when the response was received. The problem from an angular perspective is what if I am controlling the api you are requesting from. Well I could 301 your request to a different url with my own callback that contains malicious code.
This is the type of vulnerability that CORB is attempting to solve on behalf of the user.
This is also why the same request works just fine with a standard GET because the callback is simply ignored in favor of the valid JSON.
if you have a specific callback you want to execute after the response comes in I suggest taking a look at RXJS.
(This answer assumes you meant Angular (current) and not AngularJs if you meant angular js you should look into promises)
answered Dec 17 '18 at 2:01
BatoureBatoure
311
add a comment |
JSONp is deprecated in Angular. And there is a pretty rational reason why. JSONp is a request method which was previously used to insert a callback into the response body of the request. You can think of it as a solution predating the wide accepted us of promises and observables in angular.
https://angular.io/api/http/Jsonp
From your example if working JSONp would be executing ng_jsonp.__req0.finished() when the response was received. The problem from an angular perspective is what if I am controlling the api you are requesting from. Well I could 301 your request to a different url with my own callback that contains malicious code.
This is the type of vulnerability that CORB is attempting to solve on behalf of the user.
This is also why the same request works just fine with a standard GET because the callback is simply ignored in favor of the valid JSON.
if you have a specific callback you want to execute after the response comes in I suggest taking a look at RXJS.
(This answer assumes you meant Angular (current) and not AngularJs if you meant angular js you should look into promises)
answered Dec 17 '18 at 2:01
BatoureBatoure
311
add a comment |
JSONp is deprecated in Angular. And there is a pretty rational reason why. JSONp is a request method which was previously used to insert a callback into the response body of the request. You can think of it as a solution predating the wide accepted us of promises and observables in angular.
https://angular.io/api/http/Jsonp
From your example if working JSONp would be executing ng_jsonp.__req0.finished() when the response was received. The problem from an angular perspective is what if I am controlling the api you are requesting from. Well I could 301 your request to a different url with my own callback that contains malicious code.
This is the type of vulnerability that CORB is attempting to solve on behalf of the user.
This is also why the same request works just fine with a standard GET because the callback is simply ignored in favor of the valid JSON.
if you have a specific callback you want to execute after the response comes in I suggest taking a look at RXJS.
(This answer assumes you meant Angular (current) and not AngularJs if you meant angular js you should look into promises)
answered Dec 17 '18 at 2:01
BatoureBatoure
311
JSONp is deprecated in Angular. And there is a pretty rational reason why. JSONp is a request method which was previously used to insert a callback into the response body of the request. You can think of it as a solution predating the wide accepted us of promises and observables in angular.
https://angular.io/api/http/Jsonp
From your example if working JSONp would be executing ng_jsonp.__req0.finished() when the response was received. The problem from an angular perspective is what if I am controlling the api you are requesting from. Well I could 301 your request to a different url with my own callback that contains malicious code.
This is the type of vulnerability that CORB is attempting to solve on behalf of the user.
This is also why the same request works just fine with a standard GET because the callback is simply ignored in favor of the valid JSON.
if you have a specific callback you want to execute after the response comes in I suggest taking a look at RXJS.
(This answer assumes you meant Angular (current) and not AngularJs if you meant angular js you should look into promises)
answered Dec 17 '18 at 2:01
BatoureBatoure
311
answered Dec 17 '18 at 2:01
BatoureBatoure
311
answered Dec 17 '18 at 2:01
BatoureBatoure
311
answered Dec 17 '18 at 2:01
BatoureBatoure
311
311
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53431576%2finstagram-api-corb%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
http.jsonp is undefined here, but I use import { Jsonp } from '@angular/http'; So, I work through Jsonp.
– Yury Homenok
Nov 23 '18 at 5:54
Though when I use just http (not jsonp) it works.
– Yury Homenok
Nov 23 '18 at 8:14