Serving sounds do not have "Access-Control-Allow-Origin" header

[Stu]

Hi, I'm playing around with loading files from FreeSound into JavaScript, filtering by "type=wav" then using the URL in sound.serve to download the wave file. The problem is that it seems the "Access-Control-Allow-Origin" is not set when serving the original file:

  HTTP/1.1 200 OK

  Server: nginx/0.7.67

  Date: Thu, 05 Apr 2012 02:42:09 GMT

  Content-Type: application/octet-stream

  Content-Length: 398992

  Last-Modified: Wed, 04 Apr 2012 22:39:53 GMT

  Connection: keep-alive

  Content-Disposition: attachment; filename="150423__pjcohen__ottaviano22halflathedridecymbal2715gbow.wav"

  Accept-Ranges: bytes

So I can't load it from within my web app. The preview MP3/OGG files work fine, but then the library I'm using can't load MP3 or OGG.

Is this by design?

[Bram de Jong]

Hi Stu,

Original files and packs are served in a different way because we
don't want people to "crosslink" them: i.e. we don't want people to be
able to point to them directly.

This is probbaly why you are having trouble with them.

My question would be: why do you want to use the original
WAV/AIF/FLAC/OGG/... files from javascript? If this is a web
application, wouldn't mp3 or ogg be much more adequate?

- bram

--
http://www.samplesumo.com
http://www.freesound.org
http://www.smartelectronix.com
http://www.musicdsp.org

office: +32 (0) 9 335 59 25
mobile: +32 (0) 484 154 730

[Stu]

Hi Bram, thanks for your response.

The reason I was trying to use the original WAVE file was because that was the only format supported by the JS sound library I was using.

I've since switched to the Web Audio API, which supports OGG, however trying to get the OGG (or MP3) file gives me the same error.

If I simply wanted to play the file, this works, as cross-origin resource sharing does not apply:

var sound = new Audio("path_to_freesound_preview_mp3")

But trying to get the file via AJAX (so I can use it with the Web Audio API) throws an error because a "Access-Control-Allow-Origin" header is not present in the response.

I've decided to just whip up a PHP script on my server that downloads the OGG and forwards it on to avoid cross-origin issues.

On Thursday, April 5, 2012 5:46:22 PM UTC+10, Bram wrote:

Hi Stu,

Original files and packs are served in a different way because we
don't want people to "crosslink" them: i.e. we don't want people to be
able to point to them directly.

This is probbaly why you are having trouble with them.

My question would be: why do you want to use the original
WAV/AIF/FLAC/OGG/... files from javascript? If this is a web
application, wouldn't mp3 or ogg be much more adequate?

 - bram

[Bram de Jong]

Stu,

I know Javi Agenjo has had luck playing sounds directly from freesound
URL's using SoundManager2:
http://www.schillmania.com/projects/soundmanager2/

Could you show us what you are building maybe we can help?

Javi, if you are still on this list, could you share you freesound
experiment URL with us again?

- bram

[Stu]

The key problem here is XMLHttpRequest - used to load data in JavaScript - is restricted for security reasons. Usually, requests outside the current domain are blocked.

The reason I can access FreeSound's API without restriction is because every response from the FreeSound API contains the header "Access-Control-Allow-Origin: *". This means that the FreeSound API is telling the browser "It's OK to accept this data via XMLHttpRequest".

The problem comes in because the media files are hosted on a different server to the API. This server does not set the "Access-Control-Allow-Origin" header. So the download will fail, as the browser cannot find that header.

SoundManager 2 uses the HTML5 "audio" tag, which is not subject to this restriction, as it does not use XMLHttpRequest. That is why SoundManager 2 works and this doesn't. I can't use the audio tag as it is not compatible with the Web Audio API.

So in conclusion, to fix this you would have to configure your media server to set the Access-Control-Allow-Origin header.

For more information, see http://enable-cors.org/ - probably puts it more clearly than I just did!

[Bram de Jong]

Hi Stu,

ok, if you are loading files and doing more with them than just
playing them back -i.e. processing with Web Audio- then I understand
the problem!

we'll see what we can do!

- bram