Return-Path: X-Original-To: apmail-flex-dev-archive@www.apache.org Delivered-To: apmail-flex-dev-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id 118BE17A2D for ; Mon, 21 Sep 2015 20:45:07 +0000 (UTC) Received: (qmail 52500 invoked by uid 500); 21 Sep 2015 20:45:06 -0000 Delivered-To: apmail-flex-dev-archive@flex.apache.org Received: (qmail 52460 invoked by uid 500); 21 Sep 2015 20:45:06 -0000 Mailing-List: contact dev-help@flex.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@flex.apache.org Delivered-To: mailing list dev@flex.apache.org Received: (qmail 52448 invoked by uid 99); 21 Sep 2015 20:45:06 -0000 Received: from Unknown (HELO spamd1-us-west.apache.org) (209.188.14.142) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 21 Sep 2015 20:45:06 +0000 Received: from localhost (localhost [127.0.0.1]) by spamd1-us-west.apache.org (ASF Mail Server at spamd1-us-west.apache.org) with ESMTP id DB887F508F for ; Mon, 21 Sep 2015 20:45:05 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at spamd1-us-west.apache.org X-Spam-Flag: NO X-Spam-Score: 2.45 X-Spam-Level: ** X-Spam-Status: No, score=2.45 tagged_above=-999 required=6.31 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, HTML_MESSAGE=3, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=disabled Authentication-Results: spamd1-us-west.apache.org (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mx1-eu-west.apache.org ([10.40.0.8]) by localhost (spamd1-us-west.apache.org [10.40.0.7]) (amavisd-new, port 10024) with ESMTP id rED0UxyE4QKy for ; Mon, 21 Sep 2015 20:44:58 +0000 (UTC) Received: from mail-ob0-f175.google.com (mail-ob0-f175.google.com [209.85.214.175]) by mx1-eu-west.apache.org (ASF Mail Server at mx1-eu-west.apache.org) with ESMTPS id C87282039F for ; Mon, 21 Sep 2015 20:44:57 +0000 (UTC) Received: by obbbh8 with SMTP id bh8so92203232obb.0 for ; Mon, 21 Sep 2015 13:44:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:content-type; bh=lj+Dl4hdyzFTsjwe1rqYDf7YkmnWxZAvgKsMYEQS6ZQ=; b=owjF6PGIL0Hjw6CP5LF1sAgBmqKC9XrZMZrw31dUatQgNazRk7VPsrXSOmad8E+yIf 75cP4NNoYRa86bAGVYgWUSuLGPIPehBfFgJHfwhWNSW7SRXKdt4c1CNYMAgPtuCC3NvX m1UnTRjmWuBy+ia0n4I6kARrH/Z2v4TXmE0eD86EyP51q+1M7InE0X9ylbDi5mNybupZ DYcPme295WTKMkGLBCKeq2re9Z1y1rATGjkZidLJvAzplfa+ggv2XWTe5FvnQ+jdMGV4 wrpMRwDoMcIw3OiYooZktlodOroDZmzchor7iMEzM13m3iR4WO30oxZ8Mk+lzWRrHQdT hzeQ== X-Received: by 10.60.84.230 with SMTP id c6mr13467873oez.53.1442868296756; Mon, 21 Sep 2015 13:44:56 -0700 (PDT) MIME-Version: 1.0 Sender: omuppi1@gmail.com Received: by 10.76.18.110 with HTTP; Mon, 21 Sep 2015 13:44:27 -0700 (PDT) In-Reply-To: References: From: OmPrakash Muppirala Date: Mon, 21 Sep 2015 13:44:27 -0700 X-Google-Sender-Auth: wKeqKf7IEwHei1WxzB4KP5TC8Xo Message-ID: Subject: Re: More dog food To: "dev@flex.apache.org" Content-Type: multipart/alternative; boundary=089e01184a1a4938e6052047f490 --089e01184a1a4938e6052047f490 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable > > >On Mon, Sep 21, 2015 at 9:12 AM, Alex Harui wrote: > > > >>Did you try running from http:// and not just file://? I=E2=80=99m cur= ious as > to > >> how it works around browser cross-domain security. > >> > > > >We control the SuperProxy app on > >https://apache-flex-dashboard.appspot.com, > >so I went ahead and added a cross domain xml on the server. > >https://apache-flex-dashboard.appspot.com/crossdomain.xml > > > >It works fine when I run it from http://locahost and an internal remote > >server. I can try putting it up in a secret page on flex.apache.org if > we > >want test it for real. > > > >Once I get the javascript version building, I will see if it works by > >default. If not, I believe I can set the Access-Control-Allow-Origin > >header to * for the server responses which would take care of CORS in th= e > >JS version. > > If you can control the crossdomain.xml and HTTP Headers we=E2=80=99ll pro= bably be > ok, but I wouldn=E2=80=99t use *, just a small whitelist, or maybe *.a.o. > The GA SuperProxy app is built for anyone and everyone to access the data. So, I wouldn't worry about giving access to "*". At least until we figure out a place for the dashboard when it goes live. Thanks, Om --089e01184a1a4938e6052047f490--