Security considerations

[robertmuehsig]

Twitter discussion - currently we launch a plain webserver on localhost. Maybe we could avoid to launch a "real" webserver at all, see here:

https://twitter.com/robert0muehsig/status/924741177525587968

[damianh]

In a previous incarnation of sort of the same thing (but windows only), it was possible to hook into chrome, register a scheme and have the handler take the request and directly invoke it against the pipeline.

https://github.com/eVisionSoftware/Harley/blob/master/src/Harley.UI/MainWindow.xaml.cs#L23
https://github.com/eVisionSoftware/Harley/blob/master/src/Harley.UI/Owin/OwinSchemeHandlerFactory.cs#L44

I'd be really surprised if there wasn't an equivalent hook in Electron.

The hard part is probably hosting the .net code / clr in the same process. Definitely done elsewhere, but beyond my knowledge at this point.

Wondering if edge.js has anything useful to lift?

[damianh]

Well hello

https://github.com/tjanczuk/edge/blob/master/src/CoreCLREmbedding/coreclrembedding.cpp

[robertmuehsig]

Nice one - I guess currently our priorities would be to work on some basics, like easier debugging support or actual better build support (Icons for the produced app etc.), but I'm really interested in doing this 👍 (or if you have some sparetime - just sent a PR 😃 )

A big step.
Hosting the .net code / clr in the same process is a great feature.

[raffaeler]

My xcore plugin for nodejs can smoothly call any netstandard assembly from nodejs (even async stuff) [in-proc of course] without having to do nothing for the interop (I do generate the required code on the fly) and allows to call almost any method/property/indexer/event/ctor.
Could this be of any help?

[robertmuehsig]

Sure - do you have a GitHub Repo for your code?

[raffaeler]

The repo just contains the user guide and a couple of videos explaining how it works, but no sources yet.
https://github.com/raffaeler/xcore

I published the plugin here:
https://www.npmjs.com/xcorenode

There are few things that are worth to say:

1. I am going to change the C++ part heavily in order to adopt N-API which is the nodejs API which should not require to recompile the plugin for each nodejs version
2. I could use it from the standard Electron but in certain cases Electron crashes. Looking with windbg the crash, it does not depend on my plugin but noone (in chat or on github) from Electron helped me to understand the issue.
3. I am also improving the perf in the netcore side of the plugin
4. Part of the plugin is already x-plat (like for example loading coreclr) but I still have to adjust few other things to make it entirely work on linux.

If you have other questions, please let me know

[robertmuehsig]

@raffaeler Is XCore/XCoreNode similar to Edge.js but works with .NET Core?

[raffaeler]

I like to say that is more than that.
Edge.JS impose a fixed signature for the method to be called while xcorenode leave the .net developer free to shape the class at her will. Also, Edge.JS limit to methods while I allow ctos/props/methods/events, even with overloads (that were pretty difficult to implement).
The setup is also simpler. When I initially tried to use Edge.js, I had several troubles.
Instead I opted for a "self-contained deployment" so that all the required .net binaries are available and part of the plugin.
You can take a look to the npm package javascript examples to see the supported features.

Anyway, Edge.js is more mature and targets more than just .net interop, therefore please don't take my words as a critic towards Edge.js.

[yoDon]

I like the idea of trying to internalize the webserver but it would be great to maintain the option of exposing the webserver when desired (I'm working on a project where I absolutely do want the webserver reachable from other processes running on the machine)

[GregorBiswanger]

I have an idea with an own web proxy, which can not listen with Fiddler or an other HTTP Debugger.

The next idea is to allow only requests from electrons chromium browser.. It's not the best and I need help to create the web proxy with .net core..

We can give an additional option to deactivate some new security parts...

[raffaeler]

@GregorBiswanger I don't get your goal.
If you want to disable people sniffing the page, it's useless. I wrote a driver that can capture even localhost (which is "short-circuited" and is not processed from the whole network stack).
From a security perspective, once you are admin of the local machine, the game is over.