http request available without allowed_outbound_hosts setting (not supposed to do that)

[seungjin]

Repo: https://github.com/seungjin/foo.fermyon.app/tree/2e5faee533058f377f1a2a883900fe029e341b1a

No allowed_outbound_hosts set (https://github.com/seungjin/foo.fermyon.app/blob/2e5faee533058f377f1a2a883900fe029e341b1a/spin.toml)
but my cron wasm can do http request.

[itowlson]

Thanks for the detailed repro case. When I run this I see this error repeating on the cron schedule:

2025-04-08T01:45:54.257154Z ERROR spin_trigger::factors: Outbound network destination not allowed: https://www.fermyon.com
Warning: A component tried to make an outbound network connection to disallowed destination 'https://www.fermyon.com'.
To allow this request, add 'allowed_outbound_hosts = ["https://www.fermyon.com"]' to the manifest component section.
ErrorCode::HttpRequestDenied
2025-04-08T01:45:54.258255Z ERROR trigger_cron: Component cron-me failed: Error::Other("ErrorCode::HttpRequestDenied")

and no status code is printed.

Can you give us any more info about your environment please? Thanks!

[seungjin]

> spin --version
spin 3.3.0-pre0 (747c9fe9 2025-04-02)
> spin plugins list --installed
check-for-update 0.1.0 [installed]
cloud 0.11.0 [installed]
platform 0.1.0 [installed]
pluginify 0.7.0 [installed]
test 0.1 [installed]
trigger-command 0.2.2 [installed]
trigger-cron 0.1 [installed]

Umm. What else can cause the differences?

[seungjin]

Now installing trigger-command and trigger-cron from its git main branch. I will check again with most recent trigger-cron plugins.

[itowlson]

Thanks! It looks like trigger-cron is not versioned at the moment so it's hard to be sure which "0.1" it is...!

[seungjin]

spinframework/spin-trigger-cron#27
spin-trigger-cron build issue.

[itowlson]

Could you try spin plugins install --url https://github.com/fermyon/spin-trigger-cron/releases/download/canary/trigger-cron.json please? That will give you the latest binary.

[seungjin]

> spin up
Logging component stdio to ".spin/logs/"
Warning: You're using a pre-release version of Spin (3.3.0-pre0). This plugin might not be compatible (supported: >=2.0). Continuing anyway.
/var/home/seungjin/.local/share/spin/plugins/trigger-cron/trigger-cron: error while loading shared libraries: libssl.so.1.1: cannot open shared object file: No such file or directory

Serving http://127.0.0.1:3000
Available Routes:
  root: http://127.0.0.1:3000
  internal-service: http://127.0.0.1:3000/internal-service (wildcard)
A trigger exited unexpectedly. Terminating.

having libssl.so issue.

[itowlson]

Argh, okay. Possibly a mismatch between the build environment and your own environment. Give me a few minutes and I'll get a branch up that you can try building from source... Sorry for the faff...

[itowlson]

Branch for updated versions is up at spinframework/spin-trigger-cron#28

[seungjin]

Installed trigger-cron from your repo/branch and now I am getting expected result.

Warning: You're using a pre-release version of Spin (3.3.0-pre0). This plugin might not be compatible (supported: >=2.0). Continuing anyway.
Logging component stdio to ".spin/logs/"

Serving http://127.0.0.1:3000
Available Routes:
  root: http://127.0.0.1:3000
  internal-service: http://127.0.0.1:3000/internal-service (wildcard)
2025-04-08T04:29:57.187835Z ERROR spin_runtime_factors: Outbound network destination not allowed: https://www.fermyon.com
Warning: A component tried to make an outbound network connection to disallowed destination 'https://www.fermyon.com'.
To allow this request, add 'allowed_outbound_hosts = ["https://www.fermyon.com"]' to the manifest component section.
ErrorCode::HttpRequestDenied
2025-04-08T04:29:57.188540Z ERROR trigger_cron: Component cron-me failed: Error::Other("ErrorCode::HttpRequestDenied")
2025-04-08T04:30:00.195752Z ERROR spin_runtime_factors: Outbound network destination not allowed: https://www.fermyon.com
Warning: A component tried to make an outbound network connection to disallowed destination 'https://www.fermyon.com'.
To allow this request, add 'allowed_outbound_hosts = ["https://www.fermyon.com"]' to the manifest component section.
ErrorCode::HttpRequestDenied
2025-04-08T04:30:00.196112Z ERROR trigger_cron: Component cron-me failed: Error::Other("ErrorCode::HttpRequestDenied")

[itowlson]

Excellent, thanks. I think there must have been a bug in an older version of the Spin crates, and you had a version of the cron trigger that was linked to them. Glad to hear it is behaving now.