WebView feature suggestion: custom URI scheme and resource domain

[awood314]

When using the WebView with the fetchResource option, we get blocked by CORS security protection when web resources make HTTP requests to our back-end services. In order to be deliberate about what origin those services see and allow, something we've implemented in our fork is the ability to override the components of the URI scheme:

• on Mac, the choc:// application URI scheme and choc.choc domain
• on Windows, the choc.localhost domain

This doesn't implement Linux, but just thought I'd drop it here in case you may find it useful: splice#1

Thanks!

[julianstorer]

Hi Alex

Someone else had a similar problem and we solved it with this commit:
77c6a89

Does that work for you?

[awood314]

Unfortunately not. I believe that would fix CORS issues for navigation requests, but then you run into cross-origin problems when those resources make requests via XHR/fetch from javascript.

As far as I can tell, aside from making changes to the back-end to send the appropriate CORS headers to the allowed origin, the only ways around this on the client side are:

• Disable the web security of the platform WebView (for the chromium-based WebView2, this is fairly straightforward, but WkWebView does not have anything besides this undocumented, private API)
• Proxy HTTP requests from web to be handled by the native side (have to be careful here not to block the plugin main thread / webview rendering thread)

[dbadb]

I have a change in my branch that supports a user-provided options customUriScheme, customUriHome (following the pattern of userAgent) to specify the scheme and domain. Change was quite simple and can be seen here:

cannerycoders@3fe379c

I originally implemented it as an #ifdef, but found the need for multiple schemes within the same runtime.

[julianstorer]

I've implemented this with a few differences, but should do what you need. Let me know if it gives you any trouble..