SharedArrayBuffer restricted in new browser versions

[bar9]

Describe the bug

A downstream project as well as the demo on https://rhysd.github.io/vim.wasm/ are now broken on most browsers, since SharedArrayBuffer has been disabled

Steps To Reproduce

Run https://rhysd.github.io/vim.wasm/

Expected behavior

vim opens up

Actual behavior

Alert popup with message FATAL: SharedArrayBuffer is not supported by this browser. If you're using Firefox or Safari, please enable feature flag.

Screenshots/DevTools console (if possible)

Your environment

• OS: Win10
• Browser: Chrome
• Browser Version: 93

Additional context (if any)

https://caniuse.com/?search=SharedArrayBuffer
https://hacks.mozilla.org/2020/07/safely-reviving-shared-memory/

[bar9]

Looking into this for my downstream project. If setting the COEP and COOP headers will succeed, I will follow up with a PR here as well.

[rhysd]

Thank you for reporting this. SharedArrayBuffer and atomics are mandatory for this project. I've not looked into this yet, but we'd need to use ServiceWorker to address this on GitHub Pages.

https://dev.to/stefnotch/enabling-coop-coep-without-touching-the-server-2d3n

[bar9]

I can confirm that setting the headers below resolved the bug for my project (server side however):

        { "key": "Cross-Origin-Embedder-Policy", "value": "require-corp" },
        { "key": "Cross-Origin-Opener-Policy", "value": "same-origin" }

[rhysd]

Yes, setting the headers in server side is the easiest way. But https://rhysd.github.io/vim.wasm is hosted on GitHub Pages and it does not provide a way to customize headers.

[mjobuda]

Can confirm this bug on linux current firefox & brave

[rhysd]

It would not work on other browsers also. Since I joined Chrome's origin trial, it now works only on Chrome and Chromium.

[HKalbasi]

Netlify allows to set coop and coep headers and is free and as easy to use as gh-pages. Would you care to host this on netlify in addtion to gh-pages?

[westurner]

I can confirm that setting the headers below resolved the bug for my project (server side however):

Cross-Origin-Embedder-Policy: "require-corp"
Cross-Origin-Opener-Policy: "same-origin"

• https://www.google.com/search?q=github+pages+cors+headers
• https://www.google.com/search?q=gitlab+pages+cors+headers
• https://cloud.google.com/appengine/docs/legacy/standard/python/config/appref#handlers_element
• https://developers.cloudflare.com/pages/platform/functions/examples/cors-headers/
  • https://github.com/cloudflare/pages-action
• https://github.com/adamchainz/django-cors-headers#about-cors
• https://www.google.com/search?q=apache2+cors+headers+owasp
• https://gist.github.com/Stanback/7145487 nginx
• https://github.com/dokku/ansible-dokku#setting-up-a-small-vps-with-a-dokku-app
  • https://gist.github.com/MichaelJCole/2d6d30c6d4e19495c425 Dokku CORS SSL nginx template
• https://www.haproxy.com/blog/enabling-cors-in-haproxy/
• https://caddy.community/t/is-it-possible-to-override-the-access-control-allow-origin-header-on-the-reverse-proxy-backend/14489/4 LetsEncrypt ACME HTTP Challenge
• https://kusk.io/blog/kusk-configuring-your-ingress-controller-for-cors-with-openapi