Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Prevent loading resources from third party CDN #4598

Merged
merged 2 commits into from
Jul 6, 2018

Conversation

markuspoerschke
Copy link
Contributor

@markuspoerschke markuspoerschke commented May 28, 2018

Description

  • Usage of Google Fonts was removed.
  • System fonts are used instead.

Motivation and Context

  • Remove usage of Google Fonts to avoid any data protection issue.
  • Using a CDN will leak data to a third party that can be simply avoided by using system fonts instead.
  • Usage of CDNs can cause legal issues in EU countries.

Checklist

My PR contains...

  • No code changes (src/ is unmodified: changes to documentation, CI, metadata, etc.)
  • Dependency changes (any modification to dependencies in package.json)
  • Bug fixes (non-breaking change which fixes an issue)
  • Improvements (misc. changes to existing features)
  • Features (non-breaking change which adds functionality)

My changes...

  • are breaking changes to a public API (config options, System API, major UI change, etc).
  • are breaking changes to a private API (Redux, component props, utility functions, etc.).
  • are breaking changes to a developer API (npm script behavior changes, new dev system dependencies, etc).
  • are not breaking changes.

Documentation

  • My changes do not require a change to the project documentation.
  • My changes require a change to the project documentation.
  • If yes to above: I have updated the documentation accordingly.

Automated tests

  • My changes can not or do not need to be tested.
  • My changes can and should be tested by unit and/or integration tests.
  • If yes to above: I have added tests to cover my changes.
  • If yes to above: I have taken care to cover edge cases in my tests.
  • All new and existing tests passed.

Remove usage of Google Fonts to avoid any data protection issue. Using a
CDN will leak data to a third party that can be simply avoided by using
system fonts instead.

Furthermore the usage of CDNs can cause legal issues in EU countries.
@shockey
Copy link
Contributor

shockey commented Jun 1, 2018

I'd hate to see our pretty fonts go away, but I do recognize the weight of potential GDPR issues. As was discussed downstream, we could look at making this a configuration option (perhaps something generic like useExternalResources).

@webron, thoughts?

@markuspoerschke
Copy link
Contributor Author

The used fonts are licensed as following:

  • Open Sans: Apache
  • Source Code Pro: SIL Open Font License
  • Tittilium Web: SIL Open Font License

See: https://fonts.google.com/attribution

Therefore the alternative of using the Google Fonts API is to bundle the fonts directly with the build of Swagger and add it to the distribution. Then no external resources are needed and still the pretty fonts can be used.

@shockey shockey merged commit 875caab into swagger-api:master Jul 6, 2018
@shockey
Copy link
Contributor

shockey commented Jul 6, 2018

thanks @markuspoerschke!

papandreou added a commit to papandreou/swagger-ui that referenced this pull request Aug 28, 2018
papandreou added a commit to papandreou/swagger-ui-express that referenced this pull request Aug 28, 2018
swagger-ui 3.17.3 included this PR, which stopped using Google Web Fonts:
swagger-api/swagger-ui#4598

... So it's no longer necessary to load the Google Web Fonts CSS
anymore.
papandreou added a commit to papandreou/swagger-ui-express that referenced this pull request Aug 28, 2018
swagger-ui 3.17.3 included this PR, which stopped using Google Web Fonts:
swagger-api/swagger-ui#4598

... So it's no longer necessary to load the Google Web Fonts CSS.
shockey pushed a commit that referenced this pull request Sep 6, 2018
manicki added a commit to manicki/hapi-swaggered-ui that referenced this pull request Apr 12, 2019
bvanderlaan pushed a commit to bvanderlaan/swagger-ui-restify that referenced this pull request May 3, 2019
swagger-ui 3.17.3 included this PR, which stopped using Google Web Fonts:
swagger-api/swagger-ui#4598

... So it's no longer necessary to load the Google Web Fonts CSS.

(cherry picked from commit ead61ab)

Conflicts:
	indexTemplate.html
JuanSW18 pushed a commit to Digital-Paw/digital-paw-swagger-ui that referenced this pull request Aug 23, 2024
…ger-api#4598)

Remove usage of Google Fonts to avoid any data protection issue. Using a
CDN will leak data to a third party that can be simply avoided by using
system fonts instead.

Furthermore the usage of CDNs can cause legal issues in EU countries.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants