Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cross-origin isolation tracking issue #294

Open
swissspidy opened this issue Jan 3, 2024 · 3 comments
Open

Cross-origin isolation tracking issue #294

swissspidy opened this issue Jan 3, 2024 · 3 comments
Labels
documentation Improvements or additions to documentation p1

Comments

@swissspidy
Copy link
Owner

swissspidy commented Jan 3, 2024

Related:

SharedArrayBuffer is required for things like ffmpeg.wasm and wasm-vips and for this cross-origin isolation is needed.

There is a MutationObserver and a PHP class to make this as smooth as possible, but there are still some quirks here and there.

See also Cross-Origin-Embedder-Policy: credentialless status: https://developer.chrome.com/blog/coep-credentialless-origin-trial/

Known issues

Plugins using web workers

Broken embed previews in the editor

One cannot easily embed iframes in COEP environments.

There are two relevant headers/configs:

  • Cross-Origin-Embedder-Policy: credentialless (not supported in Safari)
  • <iframe credentialless> (not supported in Safari or Firefox)

#384 fixed this for Chrome, but other browsers don't yet support credentialless iframes.

So in Firefox and Safari, embed previews in the editor look like this:

Screenshot 2024-03-25 at 18 29 46

Relevant resources:

Potential workaround:

  • In Firefox & Safari, display a fallback "Sorry, this embed cannot be previewed" message
@swissspidy swissspidy added the documentation Improvements or additions to documentation label Jan 3, 2024
@swissspidy
Copy link
Owner Author

@swissspidy swissspidy added the bug Something isn't working label Mar 25, 2024
swissspidy added a commit that referenced this issue Mar 27, 2024
swissspidy added a commit that referenced this issue Mar 27, 2024
Otherwise the setting persists, even when switching browsers.

See #294
@swissspidy
Copy link
Owner Author

Broken embed previews in the editor

With 5605028 there is now at least a nicer fallback:

Screenshot 2024-03-27 at 11 18 24

@swissspidy
Copy link
Owner Author

Looks like there is a proposal for an alternative to cross-origin isolation, see #674

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
documentation Improvements or additions to documentation p1
Projects
None yet
Development

No branches or pull requests

1 participant