# RotationX, RotationY and RotationZ not working on some servers?

**URL:** <https://discourse.processing.org/t/rotationx-rotationy-and-rotationz-not-working-on-some-servers/21460>\
**Category:** p5.js\
**Created:** [May 31, 2020, 4:43pm UTC](https://discourse.processing.org/t/rotationx-rotationy-and-rotationz-not-working-on-some-servers/21460 "2020-05-31T16:43:46Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![JoeMcKay](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@JoeMcKay](https://discourse.processing.org/u/JoeMcKay)\
**Post date:** [May 31, 2020, 4:43pm UTC](https://discourse.processing.org/t/rotationx-rotationy-and-rotationz-not-working-on-some-servers/21460/1 "2020-05-31T16:43:46Z")

</div>

Hello P5 folks,  
I’m working on a WEBGL project that uses phone accelerometers. I’m finding that sketches hosted by the p5 servers work great. But when I host a project on my own server the site not longer responds to the rotation data. Is there a security issue that the P5 servers bypass somehow?  
For example, this Jiashan Wu / Daniel Shiffman sketch works great on my phone.  
[https://editor.p5js.org/shiffman/full/BJxoCbdxx](https://editor.p5js.org/shiffman/full/BJxoCbdxx)  
but when I host the same project on my greenGeeks server  
[http://www.joemckaystudio.com/Accelerometerdata/](http://www.joemckaystudio.com/Accelerometerdata/)  
it no longer works.  
And insight much appreciated.

---

<div class="post-metadata">

**Author:** ![Sven](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.processing.org/sven/32/8293_2.png) [@Sven](https://discourse.processing.org/u/Sven)\
**Post date:** [May 31, 2020, 5:11pm UTC](https://discourse.processing.org/t/rotationx-rotationy-and-rotationz-not-working-on-some-servers/21460/2 "2020-05-31T17:11:50Z")

</div>

Hello @JoeMcKay,

Web API:s that potentially reveals personal information, like sensor data, are only available in a secure context. When served over SSL/TLS. Once you make your website available over HTTPS the sketch will probably start working.

> #### 4.2.1. Secure Context
> 
> [Sensor readings](https://www.w3.org/TR/generic-sensor/#sensor-reading) are explicitly flagged by the Secure Contexts specification [[POWERFUL-FEATURES]](https://www.w3.org/TR/generic-sensor/#biblio-powerful-features) as a high-value target for network attackers. Thus all interfaces defined by this specification or [extension specifications](https://www.w3.org/TR/generic-sensor/#extension-specification) are only available within a [secure context](https://w3c.github.io/webappsec-secure-contexts/#secure-contexts).

[https://www.w3.org/TR/generic-sensor/#secure-context](https://www.w3.org/TR/generic-sensor/#secure-context)

---

<div class="post-metadata">

**Author:** ![JoeMcKay](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@JoeMcKay](https://discourse.processing.org/u/JoeMcKay)\
**Post date:** [May 31, 2020, 5:19pm UTC](https://discourse.processing.org/t/rotationx-rotationy-and-rotationz-not-working-on-some-servers/21460/3 "2020-05-31T17:19:40Z")

</div>

That make sense. I’ll work on getting the ‘s’ added to my page (Although what I hacker would do with someone’s phone rotation data is beyond me.)  
Thanks for the quick reply.

---

<div class="post-metadata">

**Author:** ![Sven](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.processing.org/sven/32/8293_2.png) [@Sven](https://discourse.processing.org/u/Sven)\
**Post date:** [May 31, 2020, 5:35pm UTC](https://discourse.processing.org/t/rotationx-rotationy-and-rotationz-not-working-on-some-servers/21460/4 "2020-05-31T17:35:00Z")

</div>

Your phone’s movement can potentially tell things about you. Are you sitting still, walking, running, sitting in a moving vehicle? Other information could probably be inferred, like figuring out what a person is typing on a smartphone keyboard. Perhaps the phone’s movement when you touch `m` on the soft keyboard differs a bit from when you touch `q`. (Just a contrived example. There are more straightforward ways to snoop on what a person is typing.)

Is it probable that a attacker would exploit this on your website? No, I don’t think so. But is it possible? Absolutely! And that’s why those API:s are only allowed within a secure context. It’s a good thing. 🙂

---

<div class="post-metadata">

**Author:** ![JoeMcKay](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@JoeMcKay](https://discourse.processing.org/u/JoeMcKay)\
**Post date:** [May 31, 2020, 5:41pm UTC](https://discourse.processing.org/t/rotationx-rotationy-and-rotationz-not-working-on-some-servers/21460/5 "2020-05-31T17:41:31Z")

</div>

Yeah, it is a good thing and it makes sense in combination with other sensors.