Please note, any whitelisting, MUST only be for the very specific URL forms noted in the documentation. It is not proposed that there be any general whitelisting for archive.org as a whole. ~~~~

@Jdforrester-WMF : Thanks for grouping.

As stated IIIF is a recognised protocol, and a whitelisting could be designed so that it's only specfic json manifest or image data that's permitted.

The other hope here is that this would enable other tools like IA-upload to be updated to only use the IIIF endpoints, rather than arbitary ones :). .

We plan to re-enable this via the allowlist, thanks for flagging.

Can I make a polite request here that if the 'endpoint' concerned whitelisted, some kind of media-type limitation is considered? (such as limiting it to JSON and relevant media types.) - I am checking to see if IA-Upload is still working.

(Aside: Ideally , IA-upload should be re-evaluted at some point, the current version is relatively old, and thus might need hardening.)

We are now supporting iiif.archive.org within the enforcing CSP, which hopefully unblocks this issue. (relevant config patch)

In T419232#11681564, @ShakespeareFan00 wrote:

Please note, any whitelisting, MUST only be for the very specific URL forms noted in the documentation. It is not proposed that there be any general whitelisting for archive.org as a whole. ~~~~

We are generally allow-listing iiif.archive.org at this time. We should definitely plan to further limit this, if feasible, in the near future.

In T419232#11682943, @ShakespeareFan00 wrote:

Can I make a polite request here that if the 'endpoint' concerned whitelisted, some kind of media-type limitation is considered? (such as limiting it to JSON and relevant media types.) - I am checking to see if IA-Upload is still working.

We can and should do this in the near future. Per-URL restrictions are potentially difficult to accommodate if it's a large list. But various media types and other CSP directives can and should be further limited.