7 ms·

Hey browser makers, please allow file:// URLS to actually be able to load other files in the same directory without giving a CORS error. You can't even run a J

by Dwedit 2y ago

Hey browser makers, please allow file:// URLS to actually be able to load other files in the same directory without giving a CORS error. You can't even run a JS file from the same directory! That's what's really killing "local first".

tlarkworthy 2y ago
I have made a notebook environment inside a single html file. You have to map dependencies in an importmap to blob URLs and it works. I have a single file website online. And you can click download to play with it locally https://tomlarkworthy.moldable.app/index.html https://tomlarkworthy.moldable.app/index.html You can turn off network and the download works.
- bsenftner 2y ago
  Very nice, written up anywhere?
  - tlarkworthy 2y ago
    still a WIP but I will write it up properly soon.
    - genewitch 2y ago
      Can this be a self-contained alarm and journaling app for cellphones? Because I can't think of a way to do that without serviceworkers. I mean a way that doesn't involve the end user reading a paragraph of instructions, based on their "OS". Anyhow, sorry, I just can't tell what it does from the confines of that demo and a cellphone browser...
      - tlarkworthy 2y ago
        No I think you need service workers for notifications. You could do journalling but it's emits a file when saving by default. Index dB works so maybe that's a possability
- mlajtos 2y ago
  Without looking into the source – GoldenLayout, right? :)
01HNNWZ0MV43FF 2y ago
That and, bring back the "new tab" custom URL, and, a way to securely host local servers without root but also without just praying that another app doesn't port-squat me
- maksimur 2y ago
  You can bind to port 0 and have the OS then pick an available port for you.
  - maksimur 2y ago
    I don't understand the downvote. OP said > a way to securely host local servers without root but also without just praying that another app doesn't port-squat me Binding to port 0 is a solution. I tested it and I always get a port not used by other programs.
    - oneeyedpigeon 2y ago
      I guess the main disadvantage is you can't reliably link to anything. Maybe not a problem if you only ever need one local server.
      - maksimur 2y ago
        That's a good point. I assumed it being a single local server per app.
      - adolph 2y ago
        Maybe this is an opportunity. Is there already a “DNS for ports” whereby the hosts file is propagated with application process identifiers that are mapped to localhost:port in hosts file?
        jmbwell 2y ago
        Careening back to inetd and /etc/services …
rpmisms 2y ago
If it's too big to include in a script tag, you don't need it. At least, that's my rule.
jankovicsandras 2y ago
I think the following works in Firefox. WARNING: this is a security risk obviously. about:config -> security.fileuri.strict_origin_policy -> false source: https://stackoverflow.com/questions/58067499/runing-javascript-in-local-html-files-in-firefox https://stackoverflow.com/questions/58067499/runing-javascri...
quink 2y ago
> "local first" Listening on 127.0.0.1:80 is local first and not being routable is in fact local-only. Its common alias ‘localhost’ even has ‘local’ in the name.
- IanCal 2y ago
  That requires having an actual server though.
  - _kidlike 2y ago
    which is extremely easy to do. Most programming languages have a one-liner to do it.
    - oneeyedpigeon 2y ago
      The best solution would allow both. Nothing quite as portable as shoving a .html file on a usb stick.
    - jagged-chisel 2y ago
      But then I want my non-technical users to experience the same benefits. So I guess I’m building an app with a web server included.
      - AlienRobot 2y ago
        I don't know why don't we have something like Java but for Javascript. Then we don't need Electron anymore.
        cxr 2y ago
        Huh?
jstanley 2y ago
You can totally load a JS file from the same directory, I do it all the time. I recall you can't use web workers, but just loading a JS file with <script> tags is fine.
- Springtime 2y ago
  You can run non-module scripts, yes, though not modules. Though it's easy enough to run a caddy local server. It was easier in the past, in earlier caddy versions one could just place the caddy binary in PATH and launch `caddy` from any directory to auto serve a local server, now it requires more arguments or a config file.
IanCal 2y ago
As usual, this sounds great for the nice players. Unfortunately that means if you download an html file and double click on it then it can send anything in your downloads folder to anywhere else.
- jagged-chisel 2y ago
  Download HTML file (and dependencies), open local file, local JS requests from internet, and CORS error. Why can it not work like this?
  - IanCal 2y ago
    > local JS requests from internet I really don't understand what this means.
    - jonhohle 2y ago
      If you load a file using the “file” protocol, it shouldn’t be able to load other resources (JS from the internet) with non-file protocols to protocols (http, https, etc.) to non null-string domains. because that would violate cross origin request sharing (CORS). I too like local HTML and would love to see it restored without requiring a local server. If I spin up a local Webrick to serve anything from my file system, I’m no better off (except maybe that it’s scoped to a particular directory and children).
      - advisedwang 2y ago
        People expect to be able to download an HTML file and for it still to be able to load an image with an external URL. If it can do that, it can exfiltrate (eg js can put data loaded from a local file in the src for an image on a external server).
        jagged-chisel 2y ago
        When I save an HTML page, the browser downloads other resources the page wants. This is how it should work for The Average User. Saving just the HTML should be the exception for more technical users.
begueradj 2y ago
From a security perspective, that's a bad thing to do.
jFriedensreich 2y ago
Because of various security issues, what you really want is something like this web standard going forward: https://developer.chrome.com/docs/web-platform/web-bundles https://developer.chrome.com/docs/web-platform/web-bundles and combine that with the js file APIs for working with data files.
diggan 2y ago
Luckily, starting a local HTTP server for development is more-or-less a one-liner for a long time, in most OSes (maybe even Windows might ship with Python nowadays?): python -m http.server 8080 If if you're stuck with python2 python -m SimpleHTTPServer 8080 At least this doesn't introduce the security issues you'd see with any file:// resource being able to load other file:// resources
- 8organicbits 2y ago
  It's not perfect either: https://docs.python.org/3/library/http.server.html#http-server-security https://docs.python.org/3/library/http.server.html#http-serv... You should also add a `--bind 127.0.0.1` so you don't expose the site to everyone on your network.
  - diggan 2y ago
    Yeah, that's a good callout, thanks. Not sure why they took the less secure approach for something that is intended as a development environment, but I think I feel like that for lots of decisions in Python so maybe not that weird in the grand scheme of things.
  - jonhohle 2y ago
    That should really be the default behavior.
  - vindex10 2y ago
    Only slightly related, but port binding in Docker also binds to 0.0.0.0 by default: `-p 8000:8000` To be safe, this should be used instead: `-p 127.0.0.1:8000:8000`
    - janci 2y ago
      It also bypasses firewall (ufw on ubuntu)
      - rzzzt 2y ago
giancarlostoro 2y ago
I think at one point Firefox used to let you open a directory and start a web server in said directory for this very reason.
zozbot234 2y ago
Why not use data: or blob: URI's instead? That ought to allow you to load resources from the "same" file, obviating security concerns from loading external resources. (Alternately you could bundle multiple files into a single ePub, though that requires a few adjustments compared to simple HTML. It's a widely supported format and allows for scripting.)
evrimoztamur 2y ago
I'm mostly resorting to self-hosting tools on my tiny server these days, but I would love it if I could run local web apps on a synced folder (a la Dropbox), and access them on my computer and mobile phone alike. With the CORS bypasses, it would be so convenient to have your own personal kanban or finance apps running and synced across multiple platforms, and remove the barrier of entry for many.
carlosjobim 2y ago
It's a prominent checkbox in the Safari developer settings to enable this.
paulddraper 2y ago
You can run a JS file from any directory.

by Dwedit 2y ago

tlarkworthy 2y ago

I have made a notebook environment inside a single html file. You have to map dependencies in an importmap to blob URLs and it works. I have a single file website online. And you can click download to play with it locally https://tomlarkworthy.moldable.app/index.html https://tomlarkworthy.moldable.app/index.html You can turn off network and the download works.

bsenftner 2y ago
Very nice, written up anywhere?
- tlarkworthy 2y ago
  still a WIP but I will write it up properly soon.
  - genewitch 2y ago
    Can this be a self-contained alarm and journaling app for cellphones? Because I can't think of a way to do that without serviceworkers. I mean a way that doesn't involve the end user reading a paragraph of instructions, based on their "OS". Anyhow, sorry, I just can't tell what it does from the confines of that demo and a cellphone browser...
    - tlarkworthy 2y ago
      No I think you need service workers for notifications. You could do journalling but it's emits a file when saving by default. Index dB works so maybe that's a possability
mlajtos 2y ago
Without looking into the source – GoldenLayout, right? :)

01HNNWZ0MV43FF 2y ago

That and, bring back the "new tab" custom URL, and, a way to securely host local servers without root but also without just praying that another app doesn't port-squat me

maksimur 2y ago
You can bind to port 0 and have the OS then pick an available port for you.
- maksimur 2y ago
  I don't understand the downvote. OP said > a way to securely host local servers without root but also without just praying that another app doesn't port-squat me Binding to port 0 is a solution. I tested it and I always get a port not used by other programs.
  - oneeyedpigeon 2y ago
    I guess the main disadvantage is you can't reliably link to anything. Maybe not a problem if you only ever need one local server.
    - maksimur 2y ago
      That's a good point. I assumed it being a single local server per app.
    - adolph 2y ago
      Maybe this is an opportunity. Is there already a “DNS for ports” whereby the hosts file is propagated with application process identifiers that are mapped to localhost:port in hosts file?
      - jmbwell 2y ago
        Careening back to inetd and /etc/services …

rpmisms 2y ago

If it's too big to include in a script tag, you don't need it. At least, that's my rule.

jankovicsandras 2y ago

I think the following works in Firefox. WARNING: this is a security risk obviously. about:config -> security.fileuri.strict_origin_policy -> false source: https://stackoverflow.com/questions/58067499/runing-javascript-in-local-html-files-in-firefox https://stackoverflow.com/questions/58067499/runing-javascri...

quink 2y ago

> "local first" Listening on 127.0.0.1:80 is local first and not being routable is in fact local-only. Its common alias ‘localhost’ even has ‘local’ in the name.

IanCal 2y ago
That requires having an actual server though.
- _kidlike 2y ago
  which is extremely easy to do. Most programming languages have a one-liner to do it.
  - oneeyedpigeon 2y ago
    The best solution would allow both. Nothing quite as portable as shoving a .html file on a usb stick.
  - jagged-chisel 2y ago
    But then I want my non-technical users to experience the same benefits. So I guess I’m building an app with a web server included.
    - AlienRobot 2y ago
      I don't know why don't we have something like Java but for Javascript. Then we don't need Electron anymore.
      - cxr 2y ago
        Huh?

jstanley 2y ago

You can totally load a JS file from the same directory, I do it all the time. I recall you can't use web workers, but just loading a JS file with <script> tags is fine.

Springtime 2y ago
You can run non-module scripts, yes, though not modules. Though it's easy enough to run a caddy local server. It was easier in the past, in earlier caddy versions one could just place the caddy binary in PATH and launch `caddy` from any directory to auto serve a local server, now it requires more arguments or a config file.

IanCal 2y ago

As usual, this sounds great for the nice players. Unfortunately that means if you download an html file and double click on it then it can send anything in your downloads folder to anywhere else.

jagged-chisel 2y ago
Download HTML file (and dependencies), open local file, local JS requests from internet, and CORS error. Why can it not work like this?
- IanCal 2y ago
  > local JS requests from internet I really don't understand what this means.
  - jonhohle 2y ago
    If you load a file using the “file” protocol, it shouldn’t be able to load other resources (JS from the internet) with non-file protocols to protocols (http, https, etc.) to non null-string domains. because that would violate cross origin request sharing (CORS). I too like local HTML and would love to see it restored without requiring a local server. If I spin up a local Webrick to serve anything from my file system, I’m no better off (except maybe that it’s scoped to a particular directory and children).
    - advisedwang 2y ago
      People expect to be able to download an HTML file and for it still to be able to load an image with an external URL. If it can do that, it can exfiltrate (eg js can put data loaded from a local file in the src for an image on a external server).
      - jagged-chisel 2y ago
        When I save an HTML page, the browser downloads other resources the page wants. This is how it should work for The Average User. Saving just the HTML should be the exception for more technical users.

begueradj 2y ago

From a security perspective, that's a bad thing to do.

jFriedensreich 2y ago

Because of various security issues, what you really want is something like this web standard going forward: https://developer.chrome.com/docs/web-platform/web-bundles https://developer.chrome.com/docs/web-platform/web-bundles and combine that with the js file APIs for working with data files.

diggan 2y ago

Luckily, starting a local HTTP server for development is more-or-less a one-liner for a long time, in most OSes (maybe even Windows might ship with Python nowadays?): python -m http.server 8080 If if you're stuck with python2 python -m SimpleHTTPServer 8080 At least this doesn't introduce the security issues you'd see with any file:// resource being able to load other file:// resources

8organicbits 2y ago
It's not perfect either: https://docs.python.org/3/library/http.server.html#http-server-security https://docs.python.org/3/library/http.server.html#http-serv... You should also add a `--bind 127.0.0.1` so you don't expose the site to everyone on your network.
- diggan 2y ago
  Yeah, that's a good callout, thanks. Not sure why they took the less secure approach for something that is intended as a development environment, but I think I feel like that for lots of decisions in Python so maybe not that weird in the grand scheme of things.
- jonhohle 2y ago
  That should really be the default behavior.
- vindex10 2y ago
  Only slightly related, but port binding in Docker also binds to 0.0.0.0 by default: `-p 8000:8000` To be safe, this should be used instead: `-p 127.0.0.1:8000:8000`
  - janci 2y ago
    It also bypasses firewall (ufw on ubuntu)
    - rzzzt 2y ago

giancarlostoro 2y ago

I think at one point Firefox used to let you open a directory and start a web server in said directory for this very reason.

zozbot234 2y ago

Why not use data: or blob: URI's instead? That ought to allow you to load resources from the "same" file, obviating security concerns from loading external resources. (Alternately you could bundle multiple files into a single ePub, though that requires a few adjustments compared to simple HTML. It's a widely supported format and allows for scripting.)

evrimoztamur 2y ago

I'm mostly resorting to self-hosting tools on my tiny server these days, but I would love it if I could run local web apps on a synced folder (a la Dropbox), and access them on my computer and mobile phone alike. With the CORS bypasses, it would be so convenient to have your own personal kanban or finance apps running and synced across multiple platforms, and remove the barrier of entry for many.

carlosjobim 2y ago

It's a prominent checkbox in the Safari developer settings to enable this.

paulddraper 2y ago

You can run a JS file from any directory.