http-server icon indicating copy to clipboard operation
http-server copied to clipboard

Cross origin isolation option

Open HKalbasi opened this issue 4 years ago • 12 comments

--coiso flag can send coop and coep headers, Which useful for webassembly thread enabling.

More info about coop and coep

HKalbasi avatar Aug 29 '20 10:08 HKalbasi

There are a handful of PRs implementing custom headers (which I need to consolidate). If custom headers could be specified, would that achieve this?

thornjad avatar Jul 13 '21 13:07 thornjad

Somehow.

This is the future security standard, something like secure context, and many features of browser will be depend on this. Custom headers would make it possible but annoying, amount of annoyance depend on custom header proposal, for example long cli flags are really annoying.

Even better than a special cli flag like --coiso or --coop, would be making it default. It seems that majority of websites should adopt this (again, like secure context) and broken cases are rare (the most common one is oauth pop-up) so making it default is a valid move (Surely with a --no-coiso for disabling it). But it will be a breaking change and this is enough for not doing it. In this case I think this is common enough and worth a special flag (like existing -c and --cors flags that have special flags)

HKalbasi avatar Jul 13 '21 20:07 HKalbasi

This issue has been inactive for 180 days

github-actions[bot] avatar Jan 10 '22 12:01 github-actions[bot]

It is still a problem to be solved. There are two PR for it but still not merged.

HKalbasi avatar Jan 10 '22 13:01 HKalbasi

This issue has been inactive for 180 days

github-actions[bot] avatar Aug 03 '22 12:08 github-actions[bot]

For people just needing a solution now, try npx statikk --port 8000 --coi.

connorjclark avatar Aug 03 '22 19:08 connorjclark

ugh, i posted a 3rd PR for this issue. can someone please look at merging one of them ?

vapier avatar Aug 11 '22 03:08 vapier

Seconded. This is an essential feature for my use-case.

PoignardAzur avatar Sep 13 '22 18:09 PoignardAzur

By the way, https://github.com/weihanglo/sfz supports this.

HKalbasi avatar Sep 14 '22 05:09 HKalbasi

unfortunately sfz isn't in npm and is written in Rust, so integrating it into existing web stacks isn't really feasible

vapier avatar Sep 14 '22 07:09 vapier

You can download the binary from their release page and execute it. It doesn't need installing whole rust toolchain.

HKalbasi avatar Sep 14 '22 10:09 HKalbasi

that requires manually tracking their releases file names, OS versions, etc... i guess technically it makes it feasible, but it's way more effort than a normal npm package

vapier avatar Sep 14 '22 10:09 vapier