NWJS Security and Cross-Origin Iframes

NWJS Version: 31.2 (Latest) Operating System: Windows 10 , April Update

Expected behavior

According to NWJS security http://docs.nwjs.io/en/latest/For Users/Advanced/Security in NW.js/#security-in-nwjs

Node frames should bypass all ‘security restrictions’

Node frames have following extra capabilities than normal frames:

Bypass all security restrictions, such as sandboxing, same origin policy etc. For example, you can make cross origin XHR to any remote sites, or access to <iframe> element whose src points to remote sites in node frames.

Chrome (latest) disables permissions by default in iframes, making permissions explicit. Another small issue is there is no way to allow all permissions e.g. allow=“all”

This deprecation is expected to ship in Chrome M64 (around January 2018). At that time, if a cross-origin iframe attempts to use permission without the feature being explicitly allowed, a console warning will be logged and the feature will fail in a similar way as it would if a user had denied a permission prompt.

It’s proposed that by default the following permissions cannot be requested or used by content contained in cross-origin iframes:

https://sites.google.com/a/chromium.org/dev/Home/chromium-security/deprecating-permissions-in-cross-origin-iframes

I’m currently unsure if a node frames scope includes to disable cross origin permissions, I would think it should unless someone corrects me.

Actual behavior

Node frames cannot bypass the new Iframe security features (Cross-Origin).

How to reproduce

1. App loads local index.html file that has an Iframe to a cross origin address. (Ensure it is a Node frame)
2. All things are node frames, package.json "node-remote": [ "*://*/*" ],

Using this does not work <iframe src="https://webrtc.github.io/samples/src/content/devices/input-output/"></iframe>

Permissions have to be explicit despite it being a node frame <iframe src="https://webrtc.github.io/samples/src/content/devices/input-output/" allow="camera;microphone;"></iframe>

Edit:

The --disable-web-security flag does not work.

[rogerwang]

You are right that the node iframe should have all the permissions by default, even it’s cross-origin. The security model in NW should override Chromium’s regarding this case. Will look to fix it.

[rogerwang]

This is fixed in git and will be available in the next nightly build.