vscode.dev can not use Simple Browser.

[aleleba]

vscode.dev can not use Simple Browser.

The problem: when try to navigate inside vscode.dev in Simple Browser, all webpages refuses connection

• VSCode Version: 1.90.2
• Local OS Version: 1.90.2
• Remote OS Version: 1.90.2
• Remote Extension/Connection Type: Tunnel

• Logs:

Steps to Reproduce:

1. Ctrl or Cmd + Shift + P
2. Search for Simple Browser
3. Try to navigate and connection refused

Does this issue occur when you try this locally?: No
Does this issue occur when you try this locally and all extensions are disabled?: No

[aleleba]

Do someone know if this is the right place to put this issue? 👍🏼 thank you in advance.

[TechnoFairyGirl]

Do someone know if this is the right place to put this issue? 👍🏼 thank you in advance.

I doubt it. This is for running VSCode on remote machines (e.g. via SSH).

[aleleba]

No with SSH, but yes on remote machines, Simple browser is not working in vscode.dev when connecting to a dev tunnel.

[connor4312]

Guessing this has to do with the security policies on vscode.dev (can be repro'd without any remote connection on the vscode.dev homepage)

[aleleba]

Guessing this has to do with the security policies on vscode.dev (can be repro'd without any remote connection on the vscode.dev homepage)

Yes, it happened because the security policies on vscode.dev, we can not use simple browser inside vscode.dev only on local it works 👍🏼

[joaomoreno]

@mjbvz We should disable Simple Browser in unsupported scenarios (ie serverless web).

[mjbvz]

It should actually work if the page sets these headers:

res.setHeader('Cross-Origin-Resource-Policy', 'cross-origin');
res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp');

The problem is that most servers do not set these. As a workaround for local development, you can make sure your dev server sets them

Afaik there's not a good way to workaround this on our side besides the credentialless attribute, but when I last tested it unfortunately it did seem to break our webviews. I can revisit this at some point. That still won't fix the simple browser completely tho as many public sites like YouTube simple do not allow themselves to be shown in iframes

[mjbvz]

Closing in favor of microsoft/vscode#228522 since it happens in core too