1

I've got several html files (TiddlyWiki Classic instances) which are stored on a USB-stick (and for it to remain removable, I open them through the file:// protocol). I use Ajax (via SharedTiddlersPlugin, but that's not that improtant) to load contents of some of them into others of them and that works nicely.

I've also set up several TWs using localhost (WAMP @ Windows 10 and a simple saving server called MicroTiddlyServer, the latest version can be found here). But "including" (via Ajax request) from localhost to file and from file to localhost does't work.

So, the question is which ways of including (loading content of an html using JavaScript) is possible:

  1. from file to localhost? Meaning that I open a TW at localhost and get contents of a file on my USB-stick (looks like a big security issue, so it's more likely that this is forbidden, at least using Ajax, but may be there's some workaround),
  2. from localhost to file? (my guess is it's possible via CORS, but adding Header set Access-Control-Allow-Origin "*" to <Directory ...> of Apache's httpd.conf prevents my server (WAMP pack @ Windows 10) from working and putting .htaccess file with the Header set Access-Control-Allow-Origin "*" content into the TW directory causes Internal Server Error \n The server encountered an internal error or misconfiguration and was unable to complete your request.)
  3. from remote server to file? (I guess this shouldn't differ much from 2. aside that I usually can't configure the server as I'm not an admin; but as I'd like to use TW as an RSS aggregator, let me include this here, too; this also would help including from and TWs on my smartphone which can be served from there using a PHP server; including to TWs on the smartphone requires localhost->remote server, though, which seems forbidden, too)

I really need some working examples (not necessarily with TW, just with html files) as I'm kinda lost in all those CORS questions and tutorials (the latter being about http, not file protocol). Actually, any working solution (not necessarily via Ajax) will do if:

  • my USB-stick remains removable at any time except for saving moment
  • the server-side part can be done at Android as well (PHP is good, Python should do as well, although I haven't tested it yet) and server config is described clearly (well, this happened to be not clear enough in my case)
  • including remains async

In fact, there's quite a number of ways described for servers, but working with file:// is somewhat different (there's no server to configure!).

The main goal of this question is to understand whether I have to create a server which will serve TWs on USB-stick once it's inserted or I can achieve all 3 goals in a "mostly client-side" way (opening TWs through file protocol). But also I hope that working examples will be helpful for others since this topic seems somewhat poorly documented.

Community
  • 1
  • 1
YakovL
  • 7,557
  • 12
  • 62
  • 102
  • you can't do that for security reason. – n00dl3 Apr 15 '16 at 12:55
  • in general its sandboxed in javascript to web access but this info might help http://www.html5rocks.com/en/tutorials/file/dndfiles/ – claya Apr 15 '16 at 12:58
  • @n00dl3 do you mean none of 1.-3. ? – YakovL Apr 15 '16 at 13:01
  • none of them, You cannot fake the `Access-Control-Allow-Origin` header via `meta` tag, so I think you're screwed... – n00dl3 Apr 15 '16 at 13:04
  • If you could do that, any website could get any file in your computer and upload it to a server: big security issue... – n00dl3 Apr 15 '16 at 13:15
  • @n00dl3 yes accessing file from a server is surely a security issue, but why accessing a server from a `file`-served html is an issue? At least accessing a localhost server? – YakovL Apr 15 '16 at 13:18

1 Answers1

1

For evident security reason this behaviour is not allowed.

from file to localhost? Meaning that I open a TW at localhost and get contents of a file on my USB-stick (looks like a big security issue, so it's more likely that this is forbidden, at least using Ajax, but may be there's some workaround),

It is not allowed as you cannot use Access-Control-Allow-Origin in an html meta tag.

from localhost to file?

from remote server to file?

Actually, that's the same, there's a web-server, so it's the same mechanism. And as no server will respond with the Access-Control-Allow-Origin header, you cannot access file:// url.

yes accessing file from a server is surely a security issue, but why accessing a server from a file-served html is an issue?

If you could do that, you could send your entire hard drive anywhere on the web just by double clicking on a file.html in your file explorer...

The only way to access your content is to serve it, sorry.

Community
  • 1
  • 1
n00dl3
  • 21,213
  • 7
  • 66
  • 76