Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add headers to enable SharedArrayBuffer in stories #16970

Merged
merged 4 commits into from
Mar 22, 2022
Merged

Add headers to enable SharedArrayBuffer in stories #16970

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
2d1c3a3
add headers required to re-enable sharedArrayBuffer
darthtrevino Dec 9, 2021
3cc4206
add required headers to enable SharedArrayBuffer
darthtrevino Dec 9, 2021
2f2fff7
streamline comment
darthtrevino Dec 9, 2021
cc835b0
Merge branch 'next' into pr/darthtrevino/16970
ndelangen Jan 5, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions lib/core-server/src/dev-server.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,10 @@ export async function storybookDevServer(options: Options) {
app.use((req, res, next) => {
res.header('Access-Control-Allow-Origin', '*');
res.header('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept');
// These headers are required to enable SharedArrayBuffer
// https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/SharedArrayBuffer
res.header('Cross-Origin-Opener-Policy', 'same-origin');
Copy link

@rmnegatives rmnegatives Mar 26, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@darthtrevino this caused me havoc on friday.
This exact example or any https:image file here got hit with cors.

// .storybook/YourTheme.js

import { create } from '@storybook/theming';

export default create({
  base: 'light',
  brandTitle: 'My custom storybook',
  brandUrl: 'https://example.com',
  brandImage: 'https://place-hold.it/350x150',
});

This also got hit with cors

<script src="https://cdn.tailwindcss.com/"></script>

Error in chrome and firefox -> "Failed to load resource: net::ERR_BLOCKED_BY_RESPONSE.NotSameOriginAfterDefaultedToSameOriginByCoep"

I traced it to my yarn lock and then traced it from alpha 45 -> to alpha 50.

When you get a chance can you check create a theme kickstart (https://storybook.js.org/docs/react/configure/theming) or even attempt to load any script "https" in preview.html ->

Copy link

@rmnegatives rmnegatives Mar 26, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok so doing more research this change forces all img and src tags to add cross-origin. Research -> Chrome Coop-Coep, The video and this section (Note: Ask the owner part)

For cross origin resources that you have no control over:
Use the crossorigin attribute in the loading HTML tag if the resource is served with CORS. (For example, <img src="***" crossorigin>.)
Ask the owner of the resource to support either CORS or CORP.

TLDR:
Ask the owner of the resource to support either CORS or CORP.

We currently do not have access to img tag for the brandImage so thats one thing but I would assume if you added crossorigin & the 3rd party/external server supported cors it would work.

However, for the tailwind url or any server that does not returns cors, the browser will block it in this 'cross-origin isolated' state.

NOTE: In the "Response" below this 3rd party resource does not return cors, so although the local dev server sets allow-access-control. Chrome will block this request.
Response

age: 91167
cache-control: max-age=0
content-length: 0
date: Fri, 25 Mar 2022 10:08:11 GMT
location: /3.0.23
server: Vercel
strict-transport-security: max-age=63072000
x-vercel-cache: HIT
x-vercel-id: iad1::iad1::qksk4-1648294058985-2d84e8e6b035

Request

:authority: cdn.tailwindcss.com
:method: GET
:path: /
:scheme: https
accept: */*
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cache-control: no-cache
pragma: no-cache
referer: http://localhost:6006/
sec-fetch-dest: script
sec-fetch-mode: no-cors
sec-fetch-site: cross-site
sec-gpc: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.74 Safari/537.36

Copy link

@rmnegatives rmnegatives Mar 26, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If my understanding is right maybe you can add COOP and COEP as a flag for story book instead, just like ssl is a flag. That way if you need shared array buffer, you will have to deal with the reality that any external resource that does not support CORS will not work.. WHICH is working as expected. However IMO I find this to be more of an edge case and therefore fits better as a flag with some caveat text around it.

res.header('Cross-Origin-Embedder-Policy', 'require-corp');
next();
});

Expand Down