bootstrap cdn site blocked security risks.

[ekicyou]

I access from inside the company, but a security risk was detected and access to "bootstrapcdn.com" was banned.

Can you change the CDN to "cdnjs.cloudflare.com"?

[jorisvandenbossche]

@ekicyou Thanks for the report!
I suppose that should be possible, yes. We were also thinking to actually bundle bootstrap with the theme, which would solve this as well I think.

[ekicyou]

@jorisvandenbossche Thanks!
We asked the security department of the company if there was any information that could be submitted, but it was said that it could not be prepared.
Although it is anonymous level information, we will request it.

[choldgraf]

I believe that if we're bundling the CSS/JS with the package, that it would be less of an issue from a security standpoint (though I could be wrong). It would also make the site work offline instead of just when connected to the internet. I think a big drawback would be that most of those CDN sites are more well-optimized than either readthedocs or github-pages, but maybe this is not a dealbreaker?

[jorisvandenbossche]

Yeah, disclaimer, I know nothing about this topic ;)
I first assumed that bundling would be better because you don't need to download the css/js from a separate CDN, but after I mentioned this I saw things like https://stackoverflow.com/questions/26192897/should-i-use-bootstrap-from-cdn-or-make-a-copy-on-my-server which mention several benefits of using a CDN instead of bundling a copy. Now, I suppose that both sides have their advantages/disadvantages.

cc @hoetmaaiers

[choldgraf]

Just a note that this is slightly more complex than "use a CDN vs. use our own servers". I assume that GitHub pages, readthedocs, netlify, and other services that host static sites also use their own CDNs to some degree. At least, I hope it is not just some random person's desktop PC serving all of those websites 😆

[hoetmaaiers]

I don't think we need to worry to much about this. It is more like an optimisation then an absolute necessity. Both CDN source or hosted next to the own styles will fit.

[choldgraf]

and I can definitely confirm from some of my sphinx extensions that there are users that want things to work in a self-contained fashion. either because they want it to work offline, or because they need to serve the website from an internal network that isn't allowed to pull in resources from the public web

[hoetmaaiers]

In PR #134 the css is CDN independent. The javascript is still required from CDN, once the javascript is also bundled in the theme this issues will be solved.

[12rambau]

I think that with the latest implementation of the dependencies, we are bundling both JS and CSS, am I wrong ?

[12rambau]

vendored since #224