CORS Errors

[dhirschfeld]

As discussed in #21 (comment) I'm seeing CORS errors when using this extension:

18 Cross-Origin Read Blocking (CORB) blocked cross-origin response <URL> with MIME type text/html. See <URL> for more details.

Cross-Origin Read Blocking (CORB) blocked cross-origin response http://server:59863/statics/images/dask-logo.svg?1535956405943 with MIME type text/html. See https://www.chromestatus.com/feature/5629709824032768 for more details.

I'm opening a separate issue here to discuss possible workarounds/fixes

[dhirschfeld]

It was suggested in the linked issue to use nbserverproxy but I'm not sure that helps with my particular usecase?

My JupyterLab instance is spawned in a container via JupyterHub on a HPC grid. In JupyterLab I can spawn a dask cluster on the same HPC grid and I would like to use this extension to monitor the progress of the dask cluster from within the JupyterLab app. The scheduler isn't running within the JupyterLab container itself so isn't available from localhost which IIUC is all nbserverproxy is intended for?

I can open a separate tab and monitor the dask cluster that way but it would be very cool to be able to do so from within JupyterLab itself, in particular to be able to arrange several windows and monitor different metrics at the same time... as shown in #18 (comment)

[dhirschfeld]

As an interim workaround how would I disable CORS as mentioned in #22 (comment)?

[dhirschfeld]

I'm not sure it's relevant, but considering the below:

dask-labextension/src/widget.tsx

Lines 433 to 438 in 1d2e87a

	// Hack Alert! We would like to test whether a given URL is actually
	// a dask dashboard, since we will be iframe-ing it sight-unseen.
	// However, CORS policies prevent us from doing a normal fetch
	// to an arbitrary URL. We *can*, however, request an image from
	// an arbitrary location. So let's request the dask logo from the
	// bokeh server statics directory and check whether that was successful.

In a new tab I can access http://server:54542/statics/dask_horizontal.svg but when I try http://server:54542/statics/dask-logo.svg I get a 404.

If I can't even access that url outside of JupyterLab, maybe that codepath won't work for me and causes the below error even though it is a dask dashboard:

http://server:54542 does not appear to host a valid Dask dashboard
Private.testDaskDashboard.then.result @ widget.js:130

[dhirschfeld]

Ok, it appears that dask-logo.svg was only added 5 days ago:

https://github.com/dask/distributed/blame/6f583f440e8a6c1635779d0618fcc60f568bdec4/distributed/bokeh/templates/base.html#L22-L24

...so I'm likely just using too old of a version!

It does appear to be in the latest release so I jsut need to update...
https://github.com/dask/distributed/blob/1.23.0/distributed/bokeh/templates/base.html#L24

[ian-r-rose]

Beat me to it! Yeah, the location to the image recently changed.

We clearly need to get some proxy recommendations in place, but for the moment: CORS policies tend to be buried in browser settings. They will, in general, be different from browser-to-browser. In particular, it seems the CORB (note B) problem you are seeing might be specific to Chrome.

[dhirschfeld]

Wondering if jupyter/notebook#3886 will help at all