WildDragonLLC/dragonflight
1
0
Fork 0
Code Issues 18 Pull requests 3 Projects Releases Packages Wiki Activity Actions

fix(filmstrip): remove crossOrigin=anonymous from probe video element

Browse source 
The /video endpoint requires session auth (requireAuth middleware).
crossOrigin='anonymous' strips cookies from the request → 401 → video
never loads → 15s timeout → filmstrip stays empty for all clips.

Same-origin video does not need crossOrigin for canvas drawImage — the
taint restriction only applies to cross-origin resources.
This commit is contained in:
Zac Gaetano 2026-05-26 16:03:26 +00:00
parent 5edb4df35a
commit b3c61134fc
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
services/web-ui/public/screens-asset.jsx
View file

@ -90,7 +90,10 @@ function AssetDetail({ asset, onClose }) {
const build = async function() {
setFilmstripLoading(true);
const probe = document.createElement('video');
probe.crossOrigin = 'anonymous';
// Do NOT set crossOrigin — the /video endpoint is same-origin and requires
// session cookies. crossOrigin='anonymous' strips credentials → 401 → load
// fails → filmstrip never builds. Same-origin video can be drawn to canvas
// without crossOrigin (no taint applies).
probe.muted = true;
probe.playsInline = true;
probe.preload = 'auto';