WEB-5905piston-meta and launchermeta have stricter CORS policy than before
How to reproduce
- Open the browser console (F12 or Ctrl+Shift+J)
- Run the following JavaScript code
fetch('https://launchermeta.mojang.com/v1/packages/a6ffa27a7b350c6fde9e65e417e9d995c40956c7/1.19.json').then(r => r.json()).then(console.log)→
Notice that the contents of the response are printed to the console
→
Since 2022-07-07 this existing domain also has a restrictive CORS policy - Run the following JavaScript code
fetch('https://piston-meta.mojang.com/v1/packages/a6ffa27a7b350c6fde9e65e417e9d995c40956c7/1.19.json').then(r => r.json()).then(console.log)→
Notice that an error is shown in the console explaining that the request was blocked by CORS policy
Expected behavior
I expected that the URLs would simply change from launchermeta.mojang.com to piston-meta.mojang.com, but remain functionally the same, this includes the CORS headers.
Note that it's not as simple as keeping using launchermeta, since the resources there link to piston-meta, thus breaking existing infrastructure relying on these APIs.
Affected open source projects
This is a seriously harmful breaking change, affecting several open source tools and resources.
- InventivetalentDev/mcasset.cloud - Website to browse through the vanilla assets
- jacobsjo/minecraft-jigsaw-preview - Jigsaw preview tool
- TechMCDocs/TechMCDocs.github.io - Technical Minecraft documentation website
- misode/report - Shows remapped stacktraces of crash reports
- MiniDigger/MiniMappingViewer - Mapping viewer website
![[Helper] Misode](../../../data/avatars/users/93314.png){kind=small}
ImportantCreated Issue:
piston-meta has stricter CORS policy than launchermeta
How to reproduce
- Open the browser console (F12 or Ctrl+Shift+J)
- Run the following JavaScript code
fetch('https://launchermeta.mojang.com/v1/packages/a6ffa27a7b350c6fde9e65e417e9d995c40956c7/1.19.json').then(r => r.json()).then(console.log)→
- Run the following JavaScript code
fetch('https://piston-meta.mojang.com/v1/packages/a6ffa27a7b350c6fde9e65e417e9d995c40956c7/1.19.json').then(r => r.json()).then(console.log)→
Expected behavior
I expected that the URLs would simply change from launchermeta.mojang.com to piston-meta.mojang.com, but remain functionally the same, this includes the CORS headers.
Note that it's not as simple as keeping using launchermeta, since the resources there link to piston-meta, thus breaking existing infrastructure relying on these APIs.
Attachments1
Normal![[Mod] SPGoding](../../../data/avatars/users/44622.png){kind=small}
![[Mojang] Web Team](../../../data/avatars/users/10122.svg){kind=small}
[Mojang] Web TeamHow to reproduce
- Open the browser console (F12 or Ctrl+Shift+J)
- Run the following JavaScript code
fetch('https://launchermeta.mojang.com/v1/packages/a6ffa27a7b350c6fde9e65e417e9d995c40956c7/1.19.json').then(r => r.json()).then(console.log)→
- Run the following JavaScript code
fetch('https://piston-meta.mojang.com/v1/packages/a6ffa27a7b350c6fde9e65e417e9d995c40956c7/1.19.json').then(r => r.json()).then(console.log)→
Expected behavior
I expected that the URLs would simply change from launchermeta.mojang.com to piston-meta.mojang.com, but remain functionally the same, this includes the CORS headers.
Note that it's not as simple as keeping using launchermeta, since the resources there link to piston-meta, thus breaking existing infrastructure relying on these APIs.
Update (2022-07-07)
It appears that the https://launchermeta.mojang.com domain now also has this restrictive CORS policy. This is a seriously harmful breaking change.
How to reproduce
- Open the browser console (F12 or Ctrl+Shift+J)
- Run the following JavaScript code
fetch('https://launchermeta.mojang.com/v1/packages/a6ffa27a7b350c6fde9e65e417e9d995c40956c7/1.19.json').then(r => r.json()).then(console.log)→
- Run the following JavaScript code
fetch('https://piston-meta.mojang.com/v1/packages/a6ffa27a7b350c6fde9e65e417e9d995c40956c7/1.19.json').then(r => r.json()).then(console.log)→
Expected behavior
I expected that the URLs would simply change from launchermeta.mojang.com to piston-meta.mojang.com, but remain functionally the same, this includes the CORS headers.
Note that it's not as simple as keeping using launchermeta, since the resources there link to piston-meta, thus breaking existing infrastructure relying on these APIs.
Update (2022-07-07)
It appears that the https://launchermeta.mojang.com domain now also has this restrictive CORS policy. This is a seriously harmful breaking change.
How to reproduce
- Open the browser console (F12 or Ctrl+Shift+J)
- Run the following JavaScript code
fetch('https://launchermeta.mojang.com/v1/packages/a6ffa27a7b350c6fde9e65e417e9d995c40956c7/1.19.json').then(r => r.json()).then(console.log)
→
→- Run the following JavaScript code
fetch('https://piston-meta.mojang.com/v1/packages/a6ffa27a7b350c6fde9e65e417e9d995c40956c7/1.19.json').then(r => r.json()).then(console.log)→
Expected behavior
I expected that the URLs would simply change from launchermeta.mojang.com to piston-meta.mojang.com, but remain functionally the same, this includes the CORS headers.
Note that it's not as simple as keeping using launchermeta, since the resources there link to piston-meta, thus breaking existing infrastructure relying on these APIs.
Affected open source projects
This is a seriously harmful breaking change, affecting several open source tools and resources.
- InventivetalentDev/mcasset.cloud - Website to browse through the vanilla assets
- jacobsjo/minecraft-jigsaw-preview - Jigsaw preview tool
- TechMCDocs/TechMCDocs.github.io - Technical Minecraft documentation website
- misode/report - Shows remapped stacktraces of crash reports
- MiniDigger/MiniMappingViewer - Mapping viewer website
piston-metahasstricter CORS policy thanlaunchermetapiston-meta and launchermeta have stricter CORS policy than before
![[Mod] violine1101](../../../data/avatars/users/92858.png){kind=small}
![[Mojang] Mega_Spud (Jay Wells)](../../../data/avatars/users/92696.png){kind=small}
I can confirm this is fixed since Aug 24