improve CORS handling by mini-browser · eclipse-theia/theia#3589

2018-11-22T08:38:56.000Z

There are 2 cases to consider: - opening a URL with `http` from Theia deployed under `https`, in this case we should notify a user about CORS issues. Right now they are only logged in the dev tool console and the mini browser is spining forever. - opening a URL with `https` scheme, in this case some pages cannot be opened in iframe (see images below). The mini-browser should detect it and propose a user to open such page in a new browser tab.

(4 留言) (0 反應) (0 負責人)TypeScript (18,676 star) (2,478 fork)batch import

enhancementhelp wantedmini-browser

描述

There are 2 cases to consider:

opening a URL with http from Theia deployed under https, in this case we should notify a user about CORS issues. Right now they are only logged in the dev tool console and the mini browser is spining forever.
opening a URL with https scheme, in this case some pages cannot be opened in iframe (see images below). The mini-browser should detect it and propose a user to open such page in a new browser tab.

貢獻者指南

技術棧: typescript
領域: frontenddesktopsecurity
議題類型: feature
難度: 3
預計時間: 3-5 days
活動狀態: stale
清晰度: mostly clear
前置要求: CORSiframe behaviorTypeScript
新手友善度: 40
研究方向: The mini browser is implemented in packages/mini browser. Look at the main component (likely mini browser.tsx) where URLs are loaded. For case 1, check window.location.protocol and show a dialog if mixed content. For case 2, handle iframe.onerror or check for X Frame Options by making a HEAD request to the URL. See https://developer.mozilla.org/en US/docs/Web/HTTP/Headers/X Frame Options for reference. Ensure to test with various HTTPS pages.