Handling legacy features/endpoints, deprecation, and redirects ⌛️

[janniks]

It seems legacy handling of the previous core.blockstack.org endpoint isn't perfect. Issue leather-io/extension#2166 shows some sites (e.g. Arkadiko) throwing errors when using previous stacks.js versions.

Inspecting Arkadiko, it looks like they are using a version of the @stacks/auth package, which still contains the old endpoint. This is causing an error to be thrown. The simple solution is for them to fix/update this issue. However, the old endpoint correctly returns a 301 redirect.

cors is enabled for the API. Tested via curl.

The stacks.js API caller function doesn't explicitly follow redirects. But I believe follow is often the default behavior for fetch. Not sure why this doesn't work. Will try to reproduce with a blockstack id.

I was only able to reproduce with apps that still use sign-in with blockstack (oauth-style blockstack.org sign-in), e.g. recall. Here the blockstack.org itself encounters the same issue (301 / cors).

I don't think following redirects could be seen as a security concern, as the only attack vector would involve an attacker using and old endpoint (so they would receive the same amount of data and at this point they could also just mimic the correct/expected successful responses to stay unnoticed). Let me know if I'm missing something 💡

---

Tip:
Running git log -S "core.blockstack.org" -p -- "*.ts" locally shows the last diffs that added/removed core.blockstack.org.