Could not acquire the player response (age-restricted videos)

Edit
The issue was partially fixed. For now only age-restricted or otherwise unavailable videos should fail to download.
If you encounter this problem with a 'normal' video, please let us know about it.
Old issue:
Apparently, YouTube keeps removing the /get_video_info endpoint. pytube (#1060) has the same issue.
We have logs and backtraces of two failed actions:

1054701372
1051037822

I guess it gets more and more clear, that we have to find a way to make the youtube-api-v1 work since /get_video_info will probably not be around for much longer.
Could anyone recommend a tool for JS reverse engineering? This would help me to find out how youtube.com handles the video download.

From what I know, youtube uses blob URLs.
You could try to see how https://github.com/ytdl-org/youtube-dl do it, because it works flawlessly.

@aviallon welcome to rustube. Your tip was great! I usually avoid youtube-dl, since the code base is just massive and messy. They actually just make one step less than we do, and this step broke.
For now, I fixed downloads of normal videos. Age-restricted videos don't work yet.
I won't have time to look into that right now and will work on that later.
Working quick fix: v0.3.5

Do you not have any example videos?

If you mean age-restricted videos, then VXDsM-1McE0 and irauhITDrsE are two examples from our tests.
For other examples of private, ... videos, you can always checkout (or expand) tests/common.rs.

For those type videos, I would recommend OAuth:
POST /youtubei/v1/player HTTP/1.1
Host: www.youtube.com
Authorization: Bearer ya29.a0ARrdaM-BeVpybKqL1LFMoLaVX8r21vKPZtViFfywS3IiQLalu...

{"context":{"client":{"clientName":"ANDROID","clientVersion":"16.05"}},
"racyCheckOk":true,"videoId":"irauhITDrsE"}

I have an implementation here if it helps:
https://github.com/89z/mech/blob/v1.20.9/youtube/oauth.go

@89z Thank you, that looks really promising!
One question regarding the Bearer token: When I understood the code correctly the auth token is acquired in func (o OAuth) Exchange() (*Exchange, error), using the hardcoded clientID and the hardcoded clientSecret.
Then, in oauth_test.go it says  Sign in to your Google Account. Is this login request unrelated, or would the OAuth solution require the user to log in to his account?

@DzenanJupic, it appears you deeply misunderstand the nature of YouTube restrictions.
You have three levels of video. You have "level 1" videos, with no restriction:
_Vyye4wNvoY

You have "level 2" videos, which can be accessed with "embed" workaround:
q4qWMcQfOCc

and you have "level 3" videos, which must use authentication:
irauhITDrsE

Again, for "level 3" videos, you must use authentication. This means either OAuth or cookies. No "hack" or "workaround" is available.

We actually had a workaround for age-restricted videos using the /get_video_info endpoint. (you can have a look at past commits and daily actions)
Unfortunately, YouTube is slowly but steadily drifting away from this endpoint and towards API v1. In a best-case scenario, we would find another way of accessing age-restricted videos without requiring the user to log in. Especially, since this adds a whole new layer of complexity.
Based on your answer I guess the answer to my previous question is: Yes, the user has to log in to download age-restricted videos using the OAuth solution.

We actually had a workaround for age-restricted videos using the /get_video_info endpoint. (you can have a look at past commits and daily actions)

I will say again, currently, it is only possible to access "level 3" videos with authentication. If you have evidence otherwise, please share it, but I am confident in my statement here.
Regarding authentication, I think OAuth is the best option, because you just have to log in one time, then you can save the access_token locally for reuse.

I did not state, that it's possible right now. That's the reason this issue exists since a recent API-change four days ago broke our code.
But before that, we were able to download i.e. irauhITDrsE , which you stated to be level 3. (this action has a log to prove it)

Regarding authentication, I think OAuth is the best option because you just have to log in one time, then you can save the access_token locally for reuse.

That actually sounds better than I expected, I will definitely try to implement it.

That actually sounds better than I expected, I will definitely try to implement it.

If you want to see the code in action, I also have a command line tool here:
https://github.com/89z/mech/tree/master/cmd/youtube
First perform the one time login process:
youtube -x

Then download a video with authentication:
youtube -c irauhITDrsE


Does tensorrt not support installation, deployment and use directly on the server?

If I am not familiar with docker, can I not use docker?

You could run without docker. There are some closed issues discussing this topic. But you might need to resolve many environment issues by yourself because we might not be able to provide to many helps if we cannot reproduce the issues you encounter.


Draft release notes for alpha.20170803

Up to commit cockroachdb/cockroach@64be211fa

This change is

http://cockroach-docs-review.s3-website-us-east-1.amazonaws.com/dd9babb742d7ba7bb56d065dfaada363a76a167f/

http://cockroach-docs-review.s3-website-us-east-1.amazonaws.com/149c6f832602c56ec21887458b0554a2af321700/

http://cockroach-docs-review.s3-website-us-east-1.amazonaws.com/a9b0f43196eeb9fe3c44bc627bf28bfbd3aa7aeb/

http://cockroach-docs-review.s3-website-us-east-1.amazonaws.com/7f2578be04202758efa4a315052f21acc51ab02e/

http://cockroach-docs-review.s3-website-us-east-1.amazonaws.com/b0b50f87dd3465e0b84abd7c1b4e10db7234579f/

I had to send these out early because I was on vacation last week - the notes as I sent them were missing a couple day's worth of changes before the final release cutoff. It looks like we still need to go back and update the release notes for that bunch of changes. I'm sorry for not being more clear about this.


using latest Nginx version instead of default apt version

The current default Nginx version installed via apt is outdated.(4 years old) It's better to use the latest stable version of Nginx to ensure we have the latest features, bug fixes, and security updates.
please use Nginx mainline repository

Done. Now the script will install the latest stable version as recommended by the developers


timestamps are not as accurate as other Whisper implementations

Hey there, the timestamps in my tests seem to be much less accurate than similar implementations (whisper.cpp or openai/whisper)

cc @Vaibhavs10

Hi @ronyfadel - Sorry for the delay in responding to you. Do you have a repro for a file that is bugging out for you?


update the schemas for triggers

Fix: #553

Codecov Report

Merging #585 (563bf7d) into master (be2972b) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master     #585   +/-   ##
=======================================
  Coverage   67.86%   67.86%
=======================================
  Files          99       99
  Lines        6170     6170
  Branches     1063     1063
=======================================
  Hits         4187     4187
  Misses       1983     1983

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update be2972b...563bf7d. Read the comment docs.


Can't Tab to any tasks

Summary
When I start creating a task, syntax highlighting and detection works but it can't detect a tab to match YAML style syntax so I have to use many spaces just to make the red curly line under the code disappear, I know the the extension is only in preview status but I really love for this issue to be fixed
Extension version
v0.4.5
VS Code version
1.60.1 83bd43bc519d15e50c4272c6cf5c1479df196a4d x64
Ansible Version
ansible [core 2.11.5]
  config file = /home/deploy/project/ansible.cfg
  configured module search path = ['/home/deploy/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3.9/site-packages/ansible
  ansible collection location = /home/deploy/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/bin/ansible
  python version = 3.9.7 (default, Aug 31 2021, 13:28:12) [GCC 11.1.0]
  jinja version = 3.0.1
  libyaml = True

OS / Environment
OS: Arch Linux
Kernel: 5.14.3-arch1-1
ansible-lint: ansible-lint 5.1.3 using ansible 2.11.5
VS Code I built from an aur package
Relevant log output
No response

Okay I figured out, I just need to edit the settings.json with this block
    "[ansible]" :{
        "editor.tabSize": 2,
        "editor.insertSpaces": true,
        "editor.autoIndent": "keep",
        "editor.quickSuggestions": {
            "other": true,
            "comments": false,
            "strings": true
        }
    },

I'm closing this issue now

@kynh-2344 Probably you observed that we fixed this in newer versions so you would not need to customize settings anymore, the defaults a just fine.
If everything is fine, please consider writing a small review on https://marketplace.visualstudio.com/items?itemName=redhat.ansible&ssr=false#review-details


OPA Gatekeeper - Remove experimental tag

Currently OPA still has the experimental flag on it.
We should remove the annotation in the chart to remove marking it experimental.

Validated on Rancher server rancher\rancher:v2.5-head version 03b8153
Experimental tag is no longer seen on OPA Gatekeeper:

Old experimental tag:


add "in" & "wip" to merge request options

These are 2 more options according to the docs https://docs.gitlab.com/ce/api/merge_requests.html#list-project-merge-requests.

LGTM!


Question about hypre's interface

Hi,
I'd like to test different options of hypre's BoomerAMG and AMS solvers and I have two questions.
(1) HypreBoomerAMG only has a private SetDefaultOptions function, do you have any plan to add some public functions to set AMG options (or AMS)?  It is easy to implement through modifying MFEM's hypre files, but I prefer to keep consistent with the official version. Or any other ways?
(2) I noticed that when using AMG as preconditioner, the hypre reference doc tells us to set MaxIter to be 1 and Tol to be 0.0, but I'm not quite sure about the reason.  Even though used as preconditioner, we still need to solve one linear equation to approximate the product between the inverse of preconditioning matrix and a vector, how does hypre control the iterations and tolerance?
Thanks

For (1), see the discussion here: https://github.com/mfem/mfem/pull/1053#discussion_r402389386.
Basically, we try to expose collection of options that seem to be useful for particular purposes. If you want to set other options, you can use the HYPRE functions directly on the MFEM object.
For (2), the overall system is solved by a Krylov method, e.g. PCG. The goal of the hypre preconditioning is to provide a cheap approximation to the inverse, hence we fix it to exactly one V-cycle (that's the effect of these options).
Hope this helps,
Tzanio

For (1), see the discussion here: #1053 (comment).
Basically, we try to expose collection of options that seem to be useful for particular purposes. If you want to set other options, you can use the HYPRE functions directly on the MFEM object.
For (2), the overall system is solved by a Krylov method, e.g. PCG. The goal of the hypre preconditioning is to provide a cheap approximation to the inverse, hence we fix it to exactly one V-cycle (that's the effect of these options).
Hope this helps,
Tzanio

Hi @tzanio, Thank you for your quick reply
(1) would be helpful and for (2), I may just need more time to learn the details of AMG and AMS approaches
Thanks again!


Importing Excel with text styles

I'm trying to import xlsx with styled text (bold, font-size, hyperlinks, etc) but all I get when trying to import it is plain text.
Is there anyway to import a file with that info? I want to convert it to html tags after that.

I don't think that it is possible. How you will get info is it bold or no?

If Excel can get that information, I think there must be a way to get it with PHP, but I don't know how. For what I've seen, this  plugin only gets plain text...

@Lydnasty I ran into this as well, and I had trouble digging up information on how to use getStyle().
I was able to grab this information through a sample code below:
Note that this is just a sample of how I was able to get the Cell formatting. One thing I did notice is that the Default fill color is 000000, so it may be a bit confusing that a background fill color is empty (which should be ffffff instead of 000000).
Hope this helps, not sure if there's a better way. Examples on the web point to getStyle through Laravel-Excel (Maatwebsite) but those examples return "undefined function getStyle". I had to do this below instead:
`
Excel::load('/path/to/xlsx/file/here.xlsx', function($reader) {
        $excel = $reader->getExcel();

        foreach($excel->getAllSheets() as $sheet)
        {
            foreach($sheet->getRowIterator() as $row)
            {
                foreach($row->getCellIterator() as $cell)
                {
                    $getStyle = $cell->getStyle();

                    $styles[] = [
                        'Fill' => $getStyle->getFill()->getStartColor()->getRGB(),
                        'Font' => $getStyle->getFont(),
                        'Borders' => $getStyle->getBorders(),
                        'Alignment' => $getStyle->getAlignment(),
                    ];
                }
            }
            dd($styles);
        }
    });

`

thx @nathanh0 (Y) worked fine for me (Y)

This works only for 2.1 version. How to do that with the 3.1 version ? There is no explanation in the docs about manipulating the imported cells...

I managed to use the WithEvents to handle the Excel file but the data returned is wrong (returns default Excel styling) :`  return [
// Handle by a closure.
BeforeImport::class => function(BeforeImport $event) {
$excel = $event->reader->getDelegate();
			foreach ( $excel->getAllSheets() as $sheet )
			{
					foreach ( $sheet->getRowIterator() as $index => $row )
					{
							foreach ( $row->getCellIterator() as $cell )
							{
									$value = $cell->getValue();

									$style = $cell->getStyle();

									echo $value.' - '.$style->getFont()->getColor()->getARGB().'<br>';
							}
					}
			}
			exit;
        },         `

This seems to work fine if the cell itself is styled, but if you have nested styles witin the text itself, it won't work, as I found out :(

@Lydnasty I ran into this as well, and I had trouble digging up information on how to use getStyle().
I was able to grab this information through a sample code below:
Note that this is just a sample of how I was able to get the Cell formatting. One thing I did notice is that the Default fill color is 000000, so it may be a bit confusing that a background fill color is empty (which should be ffffff instead of 000000).
Hope this helps, not sure if there's a better way. Examples on the web point to getStyle through Laravel-Excel (Maatwebsite) but those examples return "undefined function getStyle". I had to do this below instead:
Excel::load('/path/to/excel/file.xlsx', function($reader)
        {
            $excel = $reader->getExcel();

            foreach ( $excel->getAllSheets() as $sheet )
            {
                foreach ( $sheet->getRowIterator() as $index => $row )
                {
                    foreach ( $row->getCellIterator() as $cell )
                    {
                        $value = $cell->getValue();
                        $styles = getCellStyles($cell);

                        dd([$value => $styles]);
                    }
                }
            }
        });

    function getCellStyles($cell)
    {
        if ( ! method_exists($cell, 'getStyle') )
        {
            return false;
        }

        $getStyle = $cell->getStyle();

        $fill      = $getStyle->getFill();
        $font      = $getStyle->getFont();
        $borders   = $getStyle->getBorders();
        $alignment = $getStyle->getAlignment();

        return [
            'fill'      => [
                'color' => $fill->getFillType() == 'none' ? '' : $fill->getStartColor()->getRGB(),
                'filled' => $fill->getFillType(),
            ],
            'font'      => [
                'name'  => $font->getName(),
                'size'  => $font->getSize(),
                'color' => $font->getColor()->getRGB(),
            ],
            'borders'   => [
                'left'   => [
                    'color'     => $borders->getLeft()->getColor()->getRGB(),
                    'thickness' => $borders->getLeft()->getBorderStyle(),
                ],
                'right'  => [
                    'color'     => $borders->getRight()->getColor()->getRGB(),
                    'thickness' => $borders->getRight()->getBorderStyle(),
                ],
                'top'    => [
                    'color'     => $borders->getTop()->getColor()->getRGB(),
                    'thickness' => $borders->getTop()->getBorderStyle(),
                ],
                'bottom' => [
                    'color'     => $borders->getBottom()->getColor()->getRGB(),
                    'thickness' => $borders->getBottom()->getBorderStyle(),
                ],
            ],
            'alignment' => [
                'horizontal' => $alignment->getHorizontal(),
                'vertical'   => $alignment->getVertical(),
                'wrap'       => $alignment->getWrapText(),
                'shrink'     => $alignment->getShrinkToFit(),
                'indent'     => $alignment->getIndent(),
            ],
        ];
    }

I try to use this way in my Import file. But, the color is not detected.

Even though, I've changed the styles in my excel files for cell A8 (Corporate Strategy and Business Capabilities)


Workflows

MIGRATED FROM PRIVATE REPO
This PR will collect my work to get a few workflows organized and running before leaving on vacation :)

@amagod - this is reorganized and up and running. If you want to give it a shot, run:
./build-nodes.sh to build both the Docker image and the node definitions.
./download_and_clean_3aid.sh to run a sample workflow (note it uses a custom cache location)


Fix for 2 lora's without whitespace

now it should match things like <lora:lora1><lora:lora2:1.0> instead of treating it as a single match
Regex 101 example

@coderabbitai review


Adding branch ID as an arg for getting SMS spend

Codecov Report

Merging #155 into master will not change coverage.
The diff coverage is 100%.

@@           Coverage Diff           @@
##           master     #155   +/-   ##
=======================================
  Coverage   96.32%   96.32%
=======================================
  Files          11       11
  Lines        1470     1470
  Branches      168      168
=======================================
  Hits         1416     1416
  Misses         31       31
  Partials       23       23

Impacted Files
Coverage Δ

morpheus/app/main.py
100% <100%> (ø)
:arrow_up:

morpheus/app/views.py
95.85% <100%> (ø)
:arrow_up:

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update eeb58f7...9c8baac. Read the comment docs.


"First look at Layer Comps" commit causing assertion failure

After d0f937e6eb547544d94d18a5325932698812e511, I'm getting this exception:
  File "psd_tools/user_api/psd_image.py", line 192, in load
    return cls.from_stream(fp, encoding)
  File "psd_tools/user_api/psd_image.py", line 200, in from_stream
    psd_tools.reader.parse(fp, encoding)
  File "psd_tools/decoder/decoder.py", line 12, in parse
    new_layers = decode_layers(layer_and_mask_data.layers)
  File "psd_tools/decoder/decoder.py", line 42, in decode_layers
    ) for rec in layers.layer_records
  File "psd_tools/decoder/tagged_blocks.py", line 47, in decode
    return [parse_tagged_block(block) for block in tagged_blocks]
  File "psd_tools/decoder/tagged_blocks.py", line 59, in parse_tagged_block
    return Block(block.key, decoder(block.data))
  File "psd_tools/decoder/tagged_blocks.py", line 128, in _decode_metadata
    data = decode_descriptor(None, fp2)
  File "psd_tools/decoder/actions.py", line 81, in decode_descriptor
    name = read_unicode_string(fp)[:-1]
  File "psd_tools/utils.py", line 45, in read_unicode_string
    num_chars = read_fmt("I", fp)[0]
  File "psd_tools/utils.py", line 24, in read_fmt
    assert len(data) == fmt_size, (len(data), fmt_size)
AssertionError: (0, 4)

It looks like fp.read() in _decode_metadata gets 0 bytes.  It happens immediately on loading the file with psd_tools.PSDImage.load.  Test case: https://zewt.org/~glenn/psd-import-exception.psd

Whoops, I think I fixed the link but forgot to mention it here.  You can use the file if you still need it.


bug: Mysterious Project package bug causing app BLE transfer to stall

Ran into this error twice.
When a bad files and directories is found, the path is too long, I receive an error that the transfer isn't possible because of it. But after a restart, files and directories with the long paths are filtered out and transferring the correct files and directories are possible.

This issue was resolved.
Issue:
If the project bundle has the nested directories that contains empty copies of code.py files, an error message would appear in the debug console saying “The file path is too long and we don’t have permission to store this file on disk” then the following process of transferring the files wouldn’t happen. But the project still downloads and the error is still triggered.
This is also a UI bug because app would be stuck between having a successful download and transferring the bundle.
Resolved:
This issue was resolved by adding a check within the error condition to search from if the project bundle title exists within the file directories.
Will be added to TF2.0.1

Added filters to remove nested directories in downloaded bundles. For the time being, this is no longer a PyLeap issue. This fix will be added to TF(2.0.1)


Added impl Default for Callback

Greetings,
I've added impl Default for Callback to make it easier to provide optional callback from component properties.

Thanks @jfbilodeau!
We actually intentionally don't implement Default for Callback because it could cause unexpected behavior (devs might not realize they forgot to pass an optional callback to a component for example). I think the issue you are having will be resolved with the new Properties 2.0 proposal here: https://github.com/yewstack/yew/issues/928 It will make optional callbacks more explicit.
Feel free to weigh in!

Agreed. Props 2.0 is a much nicer solution. Thanks!


Use common templates

Proposed changes
What changed
Use common page templates in preparation for GTM work

Why did it change

Checklists
Environment variables or secrets

[x] No environment variables or secrets were added or changed

Other considerations

[ ] Update README with any new instructions or tasks

Woo browser tests!


How to control which layers are trainable?

What parameters should I change to control which layers or model params are trainable?
In the mesh tf version I can use run.variable_filter but is that also possible to add to the gin file here?

Currently you can use a MultiOptimizer to do this. We do it a lot when we use T5X for Prompt Tuning. You can find an example of doing that here https://github.com/google-research/prompt-tuning/blob/a7d507fbb01c0a5d24c9726bd61dbf966024c0d0/prompt_tuning/configs/models/t5_1_1_base_prompt.gin#L65


Lossy compression through coordinate sampling

See issue #327 for discussion of these changes.
To do before completion of this PR:

[x] @AndersMS finish appendix after coordinate system rotation
[x] @davidhassell Add references to examples to toc-extra.adoc as described in https://github.com/cf-convention/cf-conventions/issues/286
[x] @davidhassell Add terms to ch01.adoc including:

"interpolation mapping variable:: A variable used as a container for attributes that define a . The type of the variable is arbitrary since it contains no data."

Release checklist
@erget to complete:

[x] Authors updated in cf-conventions.adoc?
[x] Next version in cf-conventions.adoc up to date? Versioning inspired by SemVer.
[x] history.adoc up to date?
[x] Conformance document up-to-date?

For maintainers
After the merge remember to delete the source branch.
Tags are set at the conclusion of the annual meeting; until then master always is a draft for the next version.

Most recent PDF of all docs, built manually:
cf-conventions.pdf
We have some references missing. Will fix.

@AndersMS I see boxes also using Adobe Acrobat Reader where @JonathanGregory notes them - this is found on pg. 222. Do you know what's going on here?

Using okular, I see the boxes, too. However, viewing the file with the built-in Firefox PDF viewer, I see just a space with no box outlining box.

@JonathanGregory, @davidhassell, @erget
A special character had sneaked into the formulas cos() and sin(). I have removed it c989276 and the boxes are gone in my preview.

Thanks very much - I see that the characters are gone now. For reference I built c989276 - here's the PDF:
cf-conventions.pdf


Performence on terminal is very different within llamachat

I find the performence when using llama.cpp in terminal is better in llamachat.
The answer speed in terminal (interactive mode) is clearly faster on the same cpu usage level.
It's a little strange. Maybe it can be solved.

thanks @fsrmlgd -- one thing might be to try tweaking the number of CPU cores used for prediction in LlamaChat (in Settings > General) if this is different to llama.cpp

Thanks for your reply. The app is very helpful.
here is my test for two conditions.
https://user-images.githubusercontent.com/37462013/233781420-5c0dafc2-d201-4fca-b752-422c1b4d1b5b.mp4
https://user-images.githubusercontent.com/37462013/233781423-c425af30-640a-40b9-9987-9c5508e29f78.mov
As you can see the cat on top bar, It seems ridiculous. I change nothing about default settings.

If you need, some models can be directly used on PC are listed here.
https://huggingface.co/Pi3141
https://huggingface.co/eachadea
So make one easy to find a suitable version.

thanks @fsrmlgd, will take a look into this!

@spacecowgoesmoo thanks, still getting round to this!

Hello, here to say I experience the same issue. On terminal it works smoothly, but the GUI makes it very slow.
I am currently running on a Macbook Pro M1 with 16Gb of RAM.
btw amazing app design !


Add icons for wildfly stacks

Adds icons for the two wildfly stacks (java-wildfly and java-wildfly-bootable-jar):

Sourced from: https://design.jboss.org/wildfly/logo/final/wildfly_logomark.svg

@ehsavoie Hi Emmanuel, can you let me know if this is the right icon to use for the wildfly stacks, or if there's a more appropriate logo? Thanks!

@ehsavoie Would you mind confirming if it is the correct icon?

yes it is


[feature] Authenticate with JWT passed through response cookie.

Greetings, I'm investigating passing the jwt in the auth response as a samesite httponly cookie instead of returning it in the json payload as this library expects.
Has anyone attempted to use this package in such a way, or would anyone else be interested in using an authenticator that expects the jwt to be in a cookie and not the response body? I can help write it but I wanted to gather feedback to see if that even makes sense to add... cheers
If you have comments on the topic feel free to share!

An httponly cookie is not accessible by this library or even Ember because it is not accessible via JavaScript. So you can't use an httponly cookie to pass the JWT to the client side application.
You could use an httponly cookie without ever passing it to the client side library, but in that case, I'm not sure you would use this library at all.
You could use a cookie without httponly. But without httponly, I'm not sure you would want to use a cookie to store the JWT. You would loose all of the XSS benefits httponly cookies have, and you would now have to deal with CSRF attacks. You can limit cookies to HTTPS only (secure flag) which you can't do with local storage or session storage, but I'm still not sure that is worth the CSRF attacks.
Regardless, it should be fairly easy to use this library with cookies. You would just need to overwrite the handleAuthResponse to have it look at the cookie instead of the response body. And then you would just not use the mixin because the cookie would always be sent to the server without having to do anything special.

@fenichelar curious for your thoughts on the optimal way to handle it. From what I've been told, the optimal and most secure way is to use an httponly cookie and not return the jwt in the response body. But yes this library seems designed specifically for returning the jwt in the response body unless I have something mistaken. In my app I overload the local session by adding some bits of info to session.data, e.g. "isVerified: true". Just curious if you've used any other methods for handling jwt auth w/ember or other js apps.

@burritoIand

the optimal and most secure way is to use an httponly cookie

I don't agree with the above statement. Using httponly cookies and localstorage are different. They can both be implemented securely and they can both be implemented in insecurely.
This library is specifically designed for returning the jwt in the response body because if you are using httponly cookies, then you don't need any of the functionality in this library. An httponly cookie is by design not accessible by JavaScript, which includes ember, ember-simple-auth, and ember-simple-auth-token. When using httponly cookies, you basically just need to make the API request and if you get a 401/403/etc. error, redirect to a login page that when submitted makes a request to the server login endpoint which sets the cookie. There isn't much logic needed client side.
In summary, there isn't an optimal way of handling authentication. The various authentication designs have pros and cons that need to be considered for your specific use case. And all authentication designs have security pitfalls (XSS, CSRF, etc.) that you need to be mindful to avoid.
If you plan to use localstorage, then this library handles a lot of the logic for you. If you plan to use httponly cookies, then I can't think of any reason to use this library.

@fenichelar thank you for the response, it makes sense now. The one thing I wasn't sure of is how to store extra session data if you're using the cookie method, but I guess you'd store it as either a second non-httponly cookie or create an entry in localstorage.
Right now I'm stuffing a small number of extra boolean flags into session.data (e.g. "didUserConfirmPasswordThisSession")

@burritoIand Yes, you would need to store the session data separately. Localstorage generally makes more sense for session data because using cookies will increase the size of the requests to the server. If the server doesn't need the data, then there is no point in sending it with every request.
You could synchronize the data between localstorage and session.data or just directly use localstorage.


Unable to connect neither to C/Side nor to RTC

Hi,
after pulling latest docker images (13.0.24937.0-W1 and 13.0.24630.0-W1) I'm not able to connect neither to C/Side nor to RTC. When connecting to web client it only works if using IP address (DNS seems not to work). I'm using latest version of navcontainerhelper.
Is this issue with my machine or was there something changed?

Issues related to navcontainerhelper or docker should be filed on https://github.com/microsoft/navcontainerhelper or https://github.com/microsoft/nav-docker.
Please test your installation using this: https://blogs.msdn.microsoft.com/freddyk/2017/10/29/troubleshooting-nav-on-docker/ or using this script http://aka.ms/debug-containerhost.ps1
and if that doesn't resolve your issue, create a new issue in the right repo.


Update libsnappy.so for s390x

@xerial observed an issue with the latest libsnappy.so file published with docker cross steps. When lib/inc_linux/config.h is included in s390x builds, the generated libsnappy.so fails to uncompress. This PR is for fixing the same.
Wanted to confirm if this PR is merged, native-all (or linux-s390x) target will update native libraries to be included in next version jar, correct?

Yes. I'll trigger native lib build

@namrata-ibm
Native libraries have been built here https://github.com/xerial/snappy-java/pull/475
But I haven't checked whether this works or not in s390x. Could you try using the latest snapshot? https://oss.sonatype.org/content/repositories/snapshots/org/xerial/snappy/snappy-java/<IP_ADDRESS>-12-119cf4ce-SNAPSHOT/snappy-java-<IP_ADDRESS>-12-119cf4ce-SNAPSHOT.jar

Thank you @xerial
Yes, the latest jar is working on s390x. Could you please create an official release?
Is there a way to correct the native library in older releases - <IP_ADDRESS> and <IP_ADDRESS>? Many projects have upgraded to these versions.

Thanks. I'll release snappy-java <IP_ADDRESS> soon, but fixing the older releases is not feasible as jar files might have been copied everywhere.

Hi @namrata-ibm, are changes made in this PR somehow related to https://github.com/xerial/snappy-java/issues/464?
I checked the latest version (<IP_ADDRESS>) on RHEL7 and it fails to load. Maybe you know how this could be fixed?

@pawelszkiler this PR is not addressing the issue mentioned in #464 since the dockcross image for s390x still needs to be updated. We can check how this can be fixed.