WebView feature suggestion: custom URI scheme and resource domain

Tracktion / choc

A collection of header only classes, permissively licensed, to provide basic useful tasks with the bare-minimum of dependencies.

Other

540 stars 49 forks source link

WebView feature suggestion: custom URI scheme and resource domain #48

Closed awood314 closed 8 months ago

awood314 commented 8 months ago

When using the WebView with the fetchResource option, we get blocked by CORS security protection when web resources make HTTP requests to our back-end services. In order to be deliberate about what origin those services see and allow, something we've implemented in our fork is the ability to override the components of the URI scheme:

on Mac, the choc:// application URI scheme and choc.choc domain
on Windows, the choc.localhost domain

This doesn't implement Linux, but just thought I'd drop it here in case you may find it useful: https://github.com/splice/choc/pull/1

Thanks!

julianstorer commented 8 months ago

Hi Alex

Someone else had a similar problem and we solved it with this commit: https://github.com/Tracktion/choc/commit/77c6a89a9f2913169fb33e4857ee9d54844661dd

Does that work for you?

awood314 commented 8 months ago

Unfortunately not. I believe that would fix CORS issues for navigation requests, but then you run into cross-origin problems when those resources make requests via XHR/fetch from javascript.

As far as I can tell, aside from making changes to the back-end to send the appropriate CORS headers to the allowed origin, the only ways around this on the client side are:

Disable the web security of the platform WebView (for the chromium-based WebView2, this is fairly straightforward, but WkWebView does not have anything besides this undocumented, private API)
Proxy HTTP requests from web to be handled by the native side (have to be careful here not to block the plugin main thread / webview rendering thread)

dbadb commented 8 months ago

I have a change in my branch that supports a user-provided options customUriScheme, customUriHome (following the pattern of userAgent) to specify the scheme and domain. Change was quite simple and can be seen here:

https://github.com/cannerycoders/choc/commit/3fe379c44f1c8bbbe98bb5a505889ee0433a5532

I originally implemented it as an #ifdef, but found the need for multiple schemes within the same runtime.

julianstorer commented 8 months ago

I've implemented this with a few differences, but should do what you need. Let me know if it gives you any trouble..