Hacker News Reader

Comment by mmebane | Hacker News Reader

Is there any way to bypass CORS in a PWA? Because Chrome Apps were a really handy way of writing GUI utilities without having to go full Electron.

View on HN

No, you can't. PWAs are just "glorified" web pages. Nothing more or less. Electron is the only viable choice for desktop apps with web technologies.

Unsure, but I think if you have an extension, you can make the request in an extension page, which isn't CORS-restricted.

(I don't totally understand the difference between a Chrome app and an extension that turns itself into a PWA, both are browser-specific and both are distributed through the Chrome web store, right?)

A chrome app has access to normal sockets, local filesystem, etc.

Not sure how they'll handle this... given the risk of losing a local db store's data in chrome, I'm hoping they normalize on something.

Ideally, a directory for access/storage enough to use SQLite as via WebAssembly should be available to plugins with a request/approval for read (and optionally write) access ... to me, that should be a goal of any file system interface presented via WebAssembly, is the option for something that at least supports that use case.

There's a standardized File API https://developer.mozilla.org/en-US/docs/Web/API/File and a nonstandard FileSystem API being driven by Google https://developer.mozilla.org/en-US/docs/Web/API/FileSystem

But yeah it seems network sockets are going away. Honestly that seems good from a security perspective but I will miss the mosh app for CrOS.

If the endpoint you are requesting says it does not want to expose itself to unknown origins, that should be respected in the default config.

For testing, security research and so on you can always modify the browser config or use a proxy.

Reply on news.ycombinator.com