eclipse-theia/theia

improve CORS handling by mini-browser

Open

#3,589 opened on Nov 22, 2018

View on GitHub
 (4 comments) (0 reactions) (0 assignees)TypeScript (18,676 stars) (2,478 forks)batch import
enhancementhelp wantedmini-browser

Description

There are 2 cases to consider:

  • opening a URL with http from Theia deployed under https, in this case we should notify a user about CORS issues. Right now they are only logged in the dev tool console and the mini browser is spining forever.
  • opening a URL with https scheme, in this case some pages cannot be opened in iframe (see images below). The mini-browser should detect it and propose a user to open such page in a new browser tab.

Contributor guide

Tech stack
typescript
Domain
frontenddesktopsecurity
Issue type
feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
3-5 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
mostly clear
Prerequisites
CORSiframe behaviorTypeScript
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40
Research direction
The mini browser is implemented in packages/mini browser. Look at the main component (likely mini browser.tsx) where URLs are loaded. For case 1, check window.location.protocol and show a dialog if mixed content. For case 2, handle iframe.onerror or check for X Frame Options by making a HEAD request to the URL. See https://developer.mozilla.org/en US/docs/Web/HTTP/Headers/X Frame Options for reference. Ensure to test with various HTTPS pages.