nwjs does not remove "Cross Origin Read Blocking" from privileged frames

[julijane]

NWJS Version : 0.34.3
Operating System : Linux

Expected behavior

Documentation (http://docs.nwjs.io/en/latest/For%20Users/Advanced/Security%20in%20NW.js/) states;

Bypass all security restrictions, such as sandboxing, same origin policy etc

Actual behavior

Cross Origin Read Blocking introduced in Chrome 67 (https://www.chromestatus.com/feature/5629709824032768) is not bypassed.

This blocks lots of requests (or actually not the requests but suppresses the result), e.g. getting a text/html URI or a JSON file from resources served without CORS headers.

How to reproduce

Make a XMLHTTPRequest to e.g. a JSON file which is served without CORS-Headers.

Results in error on console:

Cross-Origin Read Blocking (CORB) blocked cross-origin response https://REDACTED with MIME type application/json. See https://www.chromestatus.com/feature/5629709824032768 for more details.

Or try to request a normal webpage (e.g. google.com) which is served as text/html. Results in the same error, with different MIME type of course.

[rogerwang]

Will look to fix this soon. Thanks for reporting.

[rogerwang]

@julijane it works for me -- I tried with a simple main html with this script with 0.34.3 and Linux:

function reqListener () {
  console.log(this.responseText);
}

var oReq = new XMLHttpRequest();
oReq.addEventListener("load", reqListener);
oReq.open("GET", "https://www.google.com");
oReq.send();

[julijane]

@rogerwang After some testing I found that it does not happen when loading from file (like in a production build). But when the application was loaded via http (e.g. from a webpack-dev-server during development) CORB blocks the request even though node-remote is set to ://localhost/

[rogerwang]

This is fixed in git and will be available in the next nightly build.

[rogerwang]

https://dl.nwjs.io/live-build/nw35/12-11-2018/63a273829/v0.35.1/