Closed michaelfig closed 6 months ago
I added more details to an inconclusive WebKit bug that's been open since 2016
What we know so far is that this *.endo.localhost
strategy is unsuitable for confinement for a number of reasons including this issue, the other being that browsers are uneven about treating localhost subdomains as isolated origins. There are a number of alternatives, and we might employ some or all of them as they have varying pros and cons.
*.parezenonopa.com
to this end and verified that it works. I believe there are some limitations to its ability to confine cookies. The strategy relies on the registrant to maintain the domain and not swap the wildcard DNS with a site that scoops your local storage etc.endo://*/
to the local HTTP server. SocketSupplyCo does not support this mode, not yet anyway, but a MacOS app or iOS app can embed a WKWebKitView with a custom protocol handler. I presume the same can be accomplished for Windows and Android.127.0.0.1:$PORT/$NONCE/
. This might look like endo install weblet weblet.js --port 8181
at the CLI.I expect the third option is the most viable in the short-term.
reserve a port number and host at
127.0.0.1:$PORT/$NONCE/
That would be acceptable.
I have added the metamask-grant-2024
label because solving this problem is necessary to prove the viability of the daemon design.
Describe the bug
refs #1006
Reported by @SMotaal, and we investigated it together.
Using
*.endo.localhost
is not adequately supported under Safari for macOS 16.2.Unlike Firefox and Chrome, which always use their own HTTPS DNS servers that support
*.localhost
in an RFC-compliant way, Safari uses the system default DNS resolver, which is probably backed by whichever Internet Service Provider is in use.Not all such providers support
*.localhost
, which makes Safari unusable for the current Endo Daemon.Steps to reproduce
ping example.endo.localhost
ping: cannot resolve example.endo.localhost
Expected behavior
There are workaround public wildcard localhost DNS providers. It would be useful to be able to specify a command line argument or environment variable to generate
*.endo${localhostSuffix}
URLs, where the defaultlocalhostSuffix = '.localhost'
.With that being supported, the Endo daemon host match regexp should be more tolerant of the specified URL suffices, something like:
Platform environment
kumavis-1kce-demo
Additional context
This works under Safari on macOS 15.
Screenshots