2 ms·
What the hell browser makers... Make it so that file:// URLS are extremely locked down and doesn't have enough rights to even fetch files in the same directory
by Dwedit 2y ago
What the hell browser makers... Make it so that file:// URLS are extremely locked down and doesn't have enough rights to even fetch files in the same directory (or even itself), yet grant localhost URLs full permissions...
There's a reason why local web applications aren't a collection of HTML and JS files, and are instead full copies of the Chromium browser.
- NavinF 2y agoWhat are you talking about? The OP made requests from his Bun server. CORS would obviously break any request made directly from js in the browser
- cyanmagenta 2y agoThe difference is that file:// URLs can be opened by your grandparent opening a .html file that they downloaded, whereas http://localhost http://localhost requires you to actually set up a web server. Imagine double-clicking a malicious page.html and suddenly your entire Documents folder can be fetched and manipulated by JavaScript. Yikes. But to your latter point, yeah, there’s no reason sandboxed web apps couldn’t be given better file:// permissions.
- recursive 2y agoThis drives me nuts. <script src> works on file, but <script type=module src> does not. In order to use ESM imports from file:// you have to load the scripts from blob:// URLs. It seems crazy to me.