search

cefsharp / CefSharp

.NET (WPF and Windows Forms) bindings for the Chromium Embedded Framework
http://cefsharp.github.io/
Other
9.83k stars 2.92k forks source link

Modification of request header collection causes video stream issues #3277

Closed Jonas-Axelsson closed 3 years ago

Jonas-Axelsson commented 3 years ago 
CefSettings settings = new CefSettings
{
    CachePath = cachePath,
    WindowlessRenderingEnabled = true,
    MultiThreadedMessageLoop = true,
    ExternalMessagePump = false
};

settings.CefCommandLineArgs.Add("enable-npapi");
settings.CefCommandLineArgs.Add("enable-media-stream");
settings.CefCommandLineArgs.Add("allow-universal-access-from-files");
settings.SetOffScreenRenderingBestPerformanceArgs();

Cef.Initialize(settings);
chromiumWebBrowser = new ChromiumWebBrowser
{
    SnapsToDevicePixels = true,
    RequestHandler = requestHandler,
    DownloadHandler = downloadHandler,
    MenuHandler = menuHandler,
    AllowDrop = true,
    LifeSpanHandler = lifeSpanHandler,
    KeyboardHandler = keyboardHandler,
    BrowserSettings = new BrowserSettings
    {
        FileAccessFromFileUrls = CefState.Enabled,
        Javascript = CefState.Enabled,
        JavascriptAccessClipboard = CefState.Enabled,
        JavascriptDomPaste = CefState.Enabled,
        UniversalAccessFromFileUrls = CefState.Enabled,
        WebGl = CefState.Enabled,
        JavascriptCloseWindows = CefState.Enabled
    }
};
amaitland commented 3 years ago

CefSharp 85.3.130 from Nuget, with custom built CEF from branch 4183 using the following flags

Does the problem reproduce if you use the Nuget package unmodified?

We traced the issue back to the IResourceRequestHandler.OnBeforeResourceLoad method, if we modify the header collection here (using either the newer IRequest.SetHeaderByName or the traditional overwriting of the IRequest.Headers collection with a modified one) the video streams malfunction as described above.

Sounds like a bug in CEF, I'd suggest moving the conversation to https://magpcss.org/ceforum/viewforum.php?f=18 and posting a link back here for reference.

It's important to remember that CefSharp is just one of many Chromium Embedded Framework(CEF) wrappers.

Jonas-Axelsson commented 3 years ago

Does the problem reproduce if you use the Nuget package unmodified?

Just tested this with a pure NuGet v85.3.130 and yes the issue reproduces for us in the same way.

Sounds like a bug in CEF, I'd suggest moving the conversation to https://magpcss.org/ceforum/viewforum.php?f=18 and posting a link back here for reference.

Alright, we will repost the issue over in the CEF forums, thanks for a quick reply!

amaitland commented 3 years ago

Just tested this with a pure NuGet v85.3.130 and yes the issue reproduces for us in the same way.

Great, that at least eliminates your custom build 👍

Can you provide a link to a YouTube video that reliably reproduces the problem?

  • an internal proxy (server side) to display web pages in an embedded fashion

Are you able to test without using a proxy?

Jonas-Axelsson commented 3 years ago

Sadly when trying to create a forum account in order to post, no activation email is sent/received (have double checked address and spam folder). All help sections related to account activation mentions contacting an administrator, but while searching for ways to contact an administrator all we have found were more login screens...

Can you provide a link to a YouTube video that reliably reproduces the problem?

When testing, any front page video seems to produce the issue, but here is a specifik link that had the issue for sure: https://www.youtube.com/watch?v=_TYRa6vxxb0

Are you able to test without using a proxy?

The application has two kinds of web views, those who route via the proxy and those who don't. We have mainly tried to solve this issue in web views that do not route via the proxy to eliminate it as the cause, so the proxy should not be a factor.

amaitland commented 3 years ago

Sadly when trying to create a forum account in order to post, no activation email is sent/received (have double checked address and spam folder). All help sections related to account activation mentions contacting an administrator, but while searching for ways to contact an administrator all we have found were more login screens...

This may take a little while. If you still have problem see https://bitbucket.org/chromiumembedded/cef/issues/3019/unable-to-get-an-activation-email-from (there's an email address you can contact)

The application has two kinds of web views, those who route via the proxy and those who don't. We have mainly tried to solve this issue in web views that do not route via the proxy to eliminate it as the cause, so the proxy should not be a factor.

Have you attempted to recreate the problem in isolation?

Jonas-Axelsson commented 3 years ago

This may take a little while. If you still have problem see https://bitbucket.org/chromiumembedded/cef/issues/3019/unable-to-get-an-activation-email-from (there's an email address you can contact)

These apparently got stuck in the company email protection service and we weren't notified until today, but we are now good to continue to post on the CEF forums.

Have you attempted to recreate the problem in isolation?

An isolated test run in the minimal example is a good idea, we will attempt to reproduce the issue there before posting on the CEF forum.

Jonas-Axelsson commented 3 years ago

Just built and modified the minimal example with a equally minimal ResourceRequestHandler (adds a single custom header to each request). This does indeed reproduce the issue! 

private const string RequestIdHeader = "CustomHeader";

public CefReturnValue OnBeforeResourceLoad(IWebBrowser chromiumWebBrowser, IBrowser browser, IFrame frame, IRequest request, IRequestCallback callback)
{
    request.SetHeaderByName(RequestIdHeader, Guid.NewGuid().ToString(), true);

    return CefReturnValue.Continue;
}

This indicates that the issue does indeed lie within CEF. We will move on to post in the forum now, including details of the test with the minimal example.

Update: Forum post approved: https://www.magpcss.org/ceforum/viewtopic.php?f=18&t=17981&e=0

Krisell commented 3 years ago

You write that the log contains nothing relevant, but couldn't blocked requests to googlevideo.com/videoplayback and more be highly relevant?

I'm not certain it's the same issue, but I recently reported a similar problem to another OSS project that adds custom headers using CefSharp. The custom headers causes plain GET-requests to no longer be classified as "simple" (see https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) which triggers a preflight request (HTTP verb OPTIONS), asking for "permission" to perform the actual request. The googlevideo API might not expect any preflights to be made, since it serves basic GET-requests from its own domain.

Here's my bug report on the other project: https://github.com/SafeExamBrowser/seb-win-refactoring/issues/46

Jonas-Axelsson commented 3 years ago

I did not previously notice the videoplayback part of the blocked request earlier while skimming over the logs for info, but now that you mention it that does indeed sound plausible, thank you for the additional information!

The main expertise area of the team lies outside of network/web development (we had no prior knowledge about CORS or the concept of pre-flight requests for example), therefore we sadly have little additional insight to share.

We will add this information to the CEF-forum ticket for reference.

amaitland commented 3 years ago

Makes sense now, I wasn't aware youtube was making CORS requests to load it's content. CORS is much stricter than it was in version 79. The Chromium Site Isolation project in particular kicked off a lot of new restrictions.

A quick test with disable-web-security and youtube would appear to load a video as expected. So basically confirming this is a CORS issue. (Don't do this in production, just for testing purposes).

As per https://www.magpcss.org/ceforum/viewtopic.php?f=18&t=17981&e=0#p47441 avoiding adding additional headers to websites that are outside of your control is the suggested course of action.

Closing now as there doesn't appear to be anything actionable from a CefSharp point of view.

DrabanL commented 3 years ago

@amaitland it seems like with latest version (v86.0.241), even with disable-web-security (WebSecurity = CefState.Disabled), videos would not load if custom header has been injected with request.SetHeaderByName.

can you verify?

EDIT:

"disable-web-security" flag must be enabled (regardless of CefSettings WebSecurity value) CefCommandLineArgs.Add("disable-web-security", "1")

amaitland commented 3 years ago

even with disable-web-security (WebSecurity = CefState.Disabled),

You'll need to use the command line arg as you've found out. The property behaves differently and I'm expecting it will be removed from CEF in the not too distant future, see https://bitbucket.org/chromiumembedded/cef/issues/3058/remove-cefbrowsersettingsweb_security