MMM-Hue CORS Policy Issue

karsten13

@fozi thanks but … no

would be better to have a solution without https, may someone else gets this figured out.

As an improvement for the above solution with https:

Holding the certs in the config directory makes them accessible from outside so better move them into a new directory beside config, e.g. certs which is not exposed. Don’t forget to update config.js afterwards.

mumblebaj

@karsten13 So I have been tinkering with the MMM-Hue module a bit and have replaced jQuery which seems to invoke XMLHttpRequest, with node-fetch, albeit the older version (2.6.1) of node-fetch, but it now returns data without requiring a certificate and the use of https.

CarstenD

The same problem appears to happen with MMM-Homematic. Getting same errors after update to 2.18.0

Access to XMLHttpRequest at 'http://192.168.178.xx/addons/xmlapi/state.cgi?datapoint_id=1824' from origin 'http://0.0.0.0:8080' has been blocked by CORS policy: The request client is not a secure context and the resource is in more-private address space private.

karsten13

@carstend

yes, was already reporty by @Fozi some posts above, MMM-Homematic uses jquery too.

OberfragGER

@karsten13 Its working now with:

var config = 
{
  electronOptions: {
		webPreferences: {
			webSecurity: false
		}
	},
  useHttps: true,
  httpsPrivateKey: "config/example.key",
  httpsCertificate: "config/example.crt",
  address: "localhost", 
  port: 8080,
//  address: '0.0.0.0',
  ipWhitelist: ["127.0.0.1", "::ffff:127.0.0.1", "::1", "::ffff:192.168.178.1/120", "192.168.178.100/24"],
  language: 'de',
  modules: [

But with this setting, i have noc access the the RemoteControl-GUI and API also! ;(
I really use it with my homeautomation to show/ hide modules.

Is there another possibility?

karsten13

@oberfragger

you must access the site with https, e.g. https://192.168.0.143:8080/remote.html

CarstenD

There is now a new version available for MMM-Homematic that also works w/o changing the config.

Fozi

@carstend Yeah, was just noted, too, about the update.
Some how I ran ino a problem when applying ‘git pull’, so I had to reinstall the module.
First the screen remained black. so I hat to install manually the ‘request’ library manually (see https://forum.magicmirror.builders/topic/15778/fix-for-black-screen-in-2-16-and-later). Now it works!

mumblebaj

@mumblebaj This is the new module I created. Does not require https.

https://github.com/mumblebaj/MMM-PhilipsHue.git

I am sure this will need to be changes once they enforce the headers stuff but for now it will work just fine.

OberfragGER

@karsten13 said in MMM-Hue CORS Policy Issue:

@oberfragger

you must access the site with https, e.g. https://192.168.0.143:8080/remote.html

Unfortunatly its not working via https. Still connection refused. I dint think that https://github.com/CatoAntonsen/MMM-MotionEye will update after 5 years.