Web version with Refresh Worker does not work when loaded from different origin (e.g. CDN)

[angelo-v]

The new refresh worker does not work if the lib is used via CDN, since the worker has to be registered on the same origin. (see also this comment)

Minimal HTML to reproduce the issue:

<script type="module">
        import {Session} from "https://unpkg.com/@uvdsl/solid-oidc-client-browser@0.2.0/dist/esm/web/index.min.js"
        new Session()
</script>

When served and opened in a browser this logs something like:

Uncaught SecurityError: Failed to construct 'SharedWorker': Script at 'https://unpkg.com/@uvdsl/solid-oidc-client-browser@0.2.0/dist/esm/web/RefreshWorker.js' cannot be accessed from origin 'http://localhost:63342'.
    at new Me (Session.ts:36:23)
    at index.html?_ijt=9864dcv3jn9ceshd0aa7oktlqi&_ij_reload=RELOAD_ON_SAVE:6:7

Possible solution

1. Provide a RefreshWorker.js on the same origin as the app, that loads the actual worker from CDN:

// RefreshWorker.js
import "https://unpkg.com/@uvdsl/solid-oidc-client-browser@0.2.1/dist/esm/web/RefreshWorker.js"

2. Then intantiate the SharedWorker in the app and pass it to the Session

const refreshWorker = new SharedWorker('./RefreshWorker.js', { type: 'module' });
new Session(refreshWorker)

For this to work the library needs to make it possible to pass the worker in the constructor as an alternative to instantiate it internally.

[uvdsl]

Thank you for raising this issue.
I am a bit hesitant to support this because there are security considerations that should be kept in mind here.
Please see also the wiki.

[angelo-v]

I overlooked that you can actually configure the worker url alreay, so my workarround (despite all security concerns) is already possible:

// RefreshWorker.js
import "https://unpkg.com/@uvdsl/solid-oidc-client-browser@0.2.1/dist/esm/web/RefreshWorker.js"

new Session(undefined, { workerUrl: './RefreshWorker.js' })

This works!

Whether the app wants to risk the dynamic import is the question the app author has to answer for themselves (yet it is could that you make aware of them)

A way to mitigate this is to download the RefreshWorker.js at build/deploy time and do an integrity check.

[uvdsl]

Well, I am happy that you found a solution to your problem. And if you really want to do this, then I just want to echo your point that the app creator needs to consider the security of their app in this.

So, from my side, please do not do this. I would not feel comfortable with such a setup. I recommend bundling this library / serving it yourself alongside your app.

[uvdsl]

@angelo-v, would you consider this issue resolved?