VS Code webview sample not running

[vibhormda]

Description

Running the vs code webview sample inside theia browser instance does not work as expected.

Reproduction Steps

1). Build theia from latest sources from master branch.
https://github.com/eclipse-theia/theia/blob/master/doc/Developing.md#quick-start

2). Follow the link to test VS code sample extensions without building the vsix file.
https://github.com/eclipse-theia/theia/wiki/Testing-VS-Code-extensions

3). The gif loads successfully but the script file fails to load inside the webview resulting in unexpected behaviour.

This issue is reproducible even after generating the vsix file from the sample and deploying it inside the plugins folder.

Webview is unable to fetch any of the locally referenced resources.
Accessing the complete resource URL externally (outside webview) also fetched nothing(404).

I observed that the URL genrateed to fecth the main.js file is also incorrect.
http://my_theia_server_hostname/webview/theia-resource/file///tmp/vscode-unpacked/cat-coding-0.0.1.vsix/extension/media/main.js

After correcting the URL (replacing file/// -> file/) the file still fails to load.

Theia server is running remotely on centOS machine and the application is accessed from browser(chrome) running on windows 10.

OS - CentOS(7.2)
Theia - build from master branch

[akosyakov]

Which browser do you use? What is the hostname on which you deploy? Do you have any errors in browser console?

Webviews work only in the secure content, https or localhost, not over http. Firefox has a bug that it does not treat subdomains of localhost as secure, so by default only Chrome.

[akosyakov]

Fetching of resources is done by Theia via the service worker, not by browser, so a URL is fine.

[vibhormda]

I am using Chrome and theia is running over non-https mode.
The host is on a local CentOS box inside internal network. Will the self signed certificate be good to make webview work ?

[akosyakov]

@vibhormda i did not try, but stackoverflow says no: https://stackoverflow.com/questions/38728176/can-you-use-a-service-worker-with-a-self-signed-certificate see for a workaround in the answer

[vibhormda]

@akosyakov Thank You for the links. I was succesfully able to run the webview sample after your inputs.

Here are the steps I am following to run theia on HTTPS mode -

export THEIA_WEBVIEW_EXTERNAL_ENDPOINT=my-theia-host
yarn run start --ssl --cert host.cert --certkey host.key --hostname 0.0.0.0 --port 443
chrome.exe --user-data-dir=/tmp/foo --ignore-certificate-errors --unsafely-treat-insecure-origin-as-secure=http://my-theia-host/

Is there any way to run the webview without setting THEIA_WEBVIEW_EXTERNAL_ENDPOINT parameter. I mean does this parameter required to be set in production environment as well ?

[akosyakov]

Webviews are designed to be treated as remote content which can access your browser state if deployed as in #7190 (comment) It is fine if you don't have any secrets, i.e. in cookies, on filesystem.

Is there any way to run the webview without setting THEIA_WEBVIEW_EXTERNAL_ENDPOINT parameter. I mean does this parameter required to be set in production environment as well ?

By default, it is set to be secured with unique origins for each webview that they cannot break out via the main window. If someone wants to disable it in production environment, then they have to consciously set it. In your case webview can access anything via Theia main window.