From b4675b70e146d24c5eb95b915c7673d424632e29 Mon Sep 17 00:00:00 2001 From: Your Name Date: Fri, 18 Sep 2026 15:18:32 +0800 Subject: [PATCH] docs: correct root-cause comment on avatar CORS investigation The OSS bucket's CORS rule does allow the app's auth headers -- just scoped to the real web/web1-5.118im.com origins. The earlier failure was from testing against a local dev origin, never in any CORS whitelist, not from OSS lacking CORS entirely. --- web/src/app/Avatar.tsx | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/web/src/app/Avatar.tsx b/web/src/app/Avatar.tsx index b58fb8e3..4f3a4284 100644 --- a/web/src/app/Avatar.tsx +++ b/web/src/app/Avatar.tsx @@ -26,13 +26,15 @@ interface AvatarProps { * back as an ALREADY-COMPLETE OSS URL in this same field (e.g. * "https://im-oss-t1.oss-cn-shenzhen.aliyuncs.com/im-assets/default-avatars/male/4.png"). A first * fix attempt stopped re-wrapping that URL into the malformed "/v0/file/s/https://..." shape but - * still routed it through `useAuthedBlobUrl`'s authenticated fetch -- live-confirmed that still - * fails: this OSS bucket's default-avatar path serves plain public assets with no CORS headers at - * all, so a cross-origin fetch carrying the app's auth headers (Bearer token, API key -- meaningless - * to OSS anyway) gets blocked at the preflight, `useAuthedBlobUrl` reports an error, and the tile - * falls back to the plain letter. An absolute URL never needs the authenticated-fetch-to-blob dance - * (that mechanism exists only to attach credentials `/v0/file/s/{id}` requires) -- render it directly - * as a plain `` instead, same as any other publicly-loadable image. + * still routed it through `useAuthedBlobUrl`'s authenticated fetch, which then failed when tested + * from a local dev origin -- turned out to be a false lead: the OSS bucket's CORS rule (checked + * directly in the Aliyun console) DOES allow this app's auth headers, just scoped to the real + * `web/web1-5.118im.com` origins, which a local dev server was never going to match regardless of + * bucket config (same class of mistake this codebase has hit before testing OSS URLs from + * localhost). The actual reason to skip `useAuthedBlobUrl` for an absolute URL isn't "CORS is + * broken" -- it's that the auth headers it attaches are meaningless to OSS for a public asset in the + * first place, so the fetch-to-blob round trip (plus its preflight) is pure overhead; render the URL + * directly as a plain `` instead, same as any other publicly-loadable image. */ export function Avatar({ id, name, avatarFileId, className = '', fallbackBgClass }: AvatarProps) { const isAbsoluteUrl = !!avatarFileId && /^https?:\/\//.test(avatarFileId);