406 Errors on GET Assets for fullscreen link

[devonelliott]

I've added a couple of files to my sketch, a .csv and .txt, that I'm trying to preload using loadTable (with the 'csv' and 'header' options) and loadStrings.

The files are in the project, but they do not appear under the 'My assets' window, and I can't find any options to add assets to that window. I added these in the project editor sidebar, where I created a folder called 'assets' and then uploaded the files.

On the fullscreen link, I get 406 (Not Acceptable) errors at the GET request for those files.

The same sketch operates fine locally on my machine, with no 406 errors. Additionally, the sketch seems to be working in the Preview within the editor. It's only in the fullscreen link where I get those 406 errors.

The errors occur in both Chrome and Safari, but the p5js sketch runs fine locally and in the editor's preview on both of those browsers.

[catarak]

thanks for reporting this!

[TheChesireCat]

Hi all,

Upon investigation of the p5.js httpDo function it seems that the content-type of the request is by default text/plain for non json/xml/text files. This conflicts with the requestsOfType middleware function

const requestsOfType = type => (req, res, next) => {
  if (req.get('content-type') != null && !req.is(type)) {
    return next({ statusCode: 406 }); // 406 UNACCEPTABLE
  }

  return next();
};

I am able to succesfully GET the csv file if I edit the request and remove the content-type header.

[catarak]

interesting! i believe this middleware was added for security reasons, so that the API would only accept JSON see https://github.com/pillarjs/understanding-csrf#how-to-mitigate-csrf-attacks. however, maybe csv and txt should be whitelisted? advice on making secure API's is much appreciated 😄

[TheChesireCat]

I believe a possible fix would be adding a requestOfTypePlain as another middleware. Similar to the requestOfTypeJSON.
The site shouldn't be vulnerable to CSRF attacks as long as the client only accepts resources from p5js affiliated urls and of known benign filetypes.

[catarak]

makes sense. thanks for the help in figuring this out!