3 ms·
Hmm, this may break a project I'm working on, depending on how far it goes. It's a web based client to a service that is commonly self hosted. Users enter the U
by Macha 5y ago
Hmm, this may break a project I'm working on, depending on how far it goes. It's a web based client to a service that is commonly self hosted. Users enter the URL of their server instance at startup. That server is frequently on the users home network. I have a public instance of the client hosted for a zero install user experience.
I think this immediate change would be fine since that public instance is a secure context, but it sounds like the ultimate direction is to prevent web->local access altogether.
- afavour 5y agoI think you should be able to provide CORS headers in the local server and have the functionality still work.
- Macha 5y agoI don't control/develop the server application. It lets users configure it and defaults CORS to pretty open access to its API endpoints. That part is fine. It just seems from this thread that the direction is to shut down that access entirely.
- afavour 5y agoI’d ignore this thread and go to the spec. If local servers are emitting CORS headers they’ll work: https://wicg.github.io/private-network-access/#example-opt-in https://wicg.github.io/private-network-access/#example-opt-i...