AI_Assistant/grid-apps-cmms
Watch
1
0
Fork
You've already forked grid-apps-cmms
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Skip COOP for iframe-embedded requests (fixes CMMS Kiri:Moto/Mesh:Tool postMessage integration)

Browse source 
Cross-Origin-Opener-Policy describes a top-level document's opener
relationship and has no defined meaning for a nested document, but
addCorsHeaders() set it unconditionally on every response - including
when this app is loaded inside an iframe by a host like CMMS. That
turned out to silently break postMessage delivery into the frame: a
well-formed same-origin message with a correct explicit targetOrigin
simply never arrived, with zero error anywhere. Confirmed via CMMS's
cam-edit.php/mesh-edit.php integration: worked perfectly visited
directly (top-level), never worked embedded - consistent across
multiple browsers and devices, ruling out a client-side cause.

Both Chrome and Firefox send Sec-Fetch-Dest: iframe on a request for an
embed, so COOP is now skipped only for that case. COEP (what
SharedArrayBuffer actually needs) stays on unconditionally either way,
and a direct top-level visit (this app's other real use, e.g. as an
installable PWA) keeps full cross-origin isolation - no regression to
the working case, fixes the broken one.
This commit is contained in:
AI Assistant 2026-08-27 18:44:42 +10:00
commit 69e3bced7c
1 changed files with 18 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

19
app.js
View file

@ -522,7 +522,24 @@ function addCorsHeaders(req, res) {
res.setHeader('Access-Control-Allow-Private-Network', 'true');
}
// if (!crossOrigin) {
res.setHeader("Cross-Origin-Opener-Policy", 'same-origin');
// COOP describes a top-level document's opener relationship - it has
// no defined meaning for a nested document, and setting it there is
// an architecture mismatch for a host like CMMS that only ever loads
// Kiri:Moto/Mesh:Tool inside an iframe: browsers apparently still act
// on a nested COOP header in ways that block postMessage delivery
// into the frame, even though messages are otherwise well-formed
// (same-origin, correct explicit targetOrigin) - CMMS integration bug,
// 2026-08-27: a postMessage-driven `load` command silently never
// reached this app at all when run/kiri/mesh was iframed, despite
// working perfectly when visited directly (top-level). Both Chrome
// and Firefox send Sec-Fetch-Dest: iframe on a request for an embed,
// so skip COOP only for that case - a direct top-level visit (this
// app's other real use, e.g. as an installable PWA) keeps full
// cross-origin isolation, COEP (which is what SharedArrayBuffer
// actually needs) stays on unconditionally either way.
if (req.headers['sec-fetch-dest'] !== 'iframe') {
res.setHeader("Cross-Origin-Opener-Policy", 'same-origin');
}
res.setHeader("Cross-Origin-Embedder-Policy", 'require-corp');
// }
res.setHeader("Allow", "GET,POST,OPTIONS");