Instructions on self-hosting widget about battleforthenet-widget

[rubbingalcoholic]

Sure-- just host the widget code on your site, then when you include it add
an extra parameter to specify the path of your self-hosted iframe directory:

<script type="text/javascript">
    // no trailing slash
    var _bftn_options = { iframe_base_path: 'relative/path/to/iframe' }
</script>
<script src="relative/path/to/widget.min.js" async></script>

Please be sure to stay up to date with commits, as we are actively
developing and will push out improvements over the next few days. Sign up
for our developer mailing list at https://www.battleforthenet.com/sept10th
to get any updates.

On Thu, Sep 4, 2014 at 2:28 PM, Dabo Ross [email protected] wrote:

I would like to include this on my website, but having it directly run
javascript that can change at any time seems like a major security risk.

Is there any possibility a zip/tar.gz download could be provided that only
uses relative URLs, or just instructions on how to make one?

—
Reply to this email directly or view it on GitHub
#5.

[daboross]

Ok awesome, thanks!

[rpgoldman]

Similar question: why does the src link in your examples not specify https?
Thanks!

[rubbingalcoholic]

Specifying // instead of http:// or https:// will use whatever transfer protocol the main page is using. So if you're using a non-HTTPS site, we'll show a non-HTTPS widget. This just saves some server overhead.

We still use HTTPS within the widget for the form submit and Call Congress tool.

[yaps8]

Related request :
Please make more explicit the relation between widget.min.js and widget.js.
I am not a web developper and I guess they are equivalent and the former is lighter (is that it ?) but it sounds tricky to say "look at widget.js" and then "but include widget.min.js".

Again I am not sure of the security implications of including an external frame into my website and I would rather not do it. So I wish you could deliver a .js version with no external reference except for links and (even better) something a total js noob like me would understand.

Anyway thank you for the effort and the good work !

[ChrisAntaki]

The first time we use a flexible protocol in an example, maybe we could point out that it'll default to HTTPS, on sites that are served over HTTPS? Then again, maybe it's just simpler to explicitly add HTTPS as a protocol, as experienced web developers will realize that probably means a flexible protocol would be safe to use if they prefer it, like I do personally.

[ChrisAntaki]

@yaps8 Thanks for your feedback! You can use the widget.js file on your site. It'll load a little slower, but many of your visitors won't notice. Also, some of them might appreciate the increased code readability.

[rubbingalcoholic]

@yaps8 I would also recommend pulling the latest code as of September 10th so you have the most current version for the day of action. We're constantly rolling out improvements.

[emma-sg]

@yaps8 Yeah, as was (sort of) mentioned before, widget.js and widget.min.js are the same code, but widget.min.js just uses less characters to do the same thing. It just loads a little faster (it's not really a big difference.)