Skip to content

fix: resolve the WebSocket URL from the page origin in blob workers - #267

Open
resure wants to merge 1 commit into
rstackjs:mainfrom
resure:fix/blob-worker-websocket-origin
Open

resure wants to merge 1 commit into
rstackjs:mainfrom
resure:fix/blob-worker-websocket-origin

Conversation

@resure

@resure resure commented Sep 30, 2026 •

Copy link
Copy Markdown

The dev-server client is injected into every entry, workers included. Some setups start a worker from a blob: URL, for example a small blob that sets the public path and calls importScripts so worker code can load from a CDN. In such a worker self.location has the blob: protocol and an empty hostname and port, so when the dev server runs plain HTTP behind a TLS-terminating proxy, the client never replaces hostname=0.0.0.0 with the page's host or upgrades ws: to wss:. It tries ws://0.0.0.0/..., and on an HTTPS page new WebSocket throws a SecurityError while the worker is loading, which the page receives as a worker error. Forcing webSocketURL.protocol to wss only turns that into endless reconnects to wss://0.0.0.0.

With this change, a blob: worker with a real origin takes the hostname, protocol and port from self.location.origin, which is the origin of the page that created it, and connects to the same socket as the page. Pages, http(s) workers, explicitly configured hostnames and protocols, data: workers and blob workers with an opaque ('null') origin behave as before.

This PR is mostly AI generated, but I've verified fix on a real project.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant