HTML source

steve64 · 2025-01-15T09:16:23+00:00

Is there a way to get the HTML source of a document after loading with Webview? I tried something like: web:eval('document.documentElement.outerHTML') but wi...

steve64

I tried the local file, but still there's an issue:
Access to fetch at '[Login to see the link]:... from origin 'null' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header has a value '[Login to see the link]' that is not equal to the supplied origin. Have the server send the header with a valid value, or, if an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

Samir

Can you try with a Virtual Host ?

The CORS policy is a security feature that exposes to attack when disabled.

Samir

More info on this here : [Login to see the link]

Samir

Can you post a minimal example that reproduces this with cross origins requests (ie requests between local page and a distant api ?)

steve64

Sorry but I'm using a specific service through their SDK and my own secret credentials, I do not think it would be feasible and helpful. I also tried to load the same page from a local Web server but same failure.

Samir

Ok don't worry i can reproduce it

Samir

You should read this : [Login to see the link]

It's a common problem. It's dangerous to use distant content to be executed localy.

I will see if it's possible to provide a way possible to bypass CORS policy if needed

steve64

Many thanks! To clarify more the context, my goal would be to use LuaRT to develop Windows clients that call remote services through REST APIs or their own client SDKs, but so far this looks difficult due to the many security aspects.
Actually I would like to use the Webview object only to integrate web contents and directly rely on your nice "net" module functions for REST APIs. But currently Webview seemed useful to bypass some constraints.

Samir

I have some good news, I have tried to disable CORS policy for the Webview widget, and it works. If everything works as expected, it will be available in next LuaRT release

steve64

Great! When do you plan to release it?

Samir

steve64 with LuaRT 1.9.1 hopefully in the coming two weeks (Webview widget will be updated and rewritten totally, with latest version from Microsoft) because I have to check if everything is right.

wll8

Assuming WebView supports command line arguments and CDP (Chrome DevTools Protocol), many functionalities can be extended by the users themselves. This way, there's no need to manually implement certain functionalities on LuaRT.

Samir

I have a preliminary CDP support too 😉

lua555

[Login to see the link]

I feel that this webview api is quite a lot. Here is the download address for reference only.

[Login to see the link]

steve64

Ok., thanks a lot.
Anyway, I did some further tests with direct REST API usage (net.Http).
I'm able to access "mock" services (from LuaRT w/o webview) like the ones found at: [Login to see the link]
So it seems there is no issue related to use a company laptop, firewall/proxy, SSL, ecc.
I suspect the problem arises when using REST servers with authentication, triggering things like pre-flight/CORS.
Do you think it's possible to manage CORS in a custom way also for your net.Http class?

wll8

steve64

CORS has no relation to the backend HTTP library; it is a browser policy. It exists in WebView or browsers. When using WebView, you can disable CORS with the --disable-web-security command-line argument. You also need to specify the --user-data-dir argument at the same time.

Additionally, you can create a local mock service to obtain a powerful and fully controllable private simulation service. For reference, see: [Login to see the link]

Samir

I will check this, but I don't think it's possible because CORS is a browser policy. Maybe by using the right headers fields

steve64

ok, thanks for your clarifications

« Previous Page