Embbeded Webcontainer doesnt work #2100
Description
Describe the bug
Having this error in embedded project
Unable to run Embedded Project
Looks like this project is being embedded without proper isolation headers.
[Read more about browser support for embedded projects](https://developer.stackblitz.com/platform/webcontainers/browser-support#embedding)
We tried to add headers like credentialless of cross-origin isolation but it didnt work.
Issue also ocures locally
Link to the blitz that caused the error
https://ensnode.io/docs/integrate/integration-options/enskit/example
https://stackblitz.com/edit/w4ozjb2k?file=src%2FApp.tsx
Steps to reproduce
Simply go to url and see the error
Expected behavior
Previously we have this example worked fine
Parity with Local
- I have run the project in my local machine and I could not reproduce the issue.
Screenshots
Platform
- OS: macOS
- Browser: Chrome, Brave
- Version:
"@stackblitz/sdk": "^1.11.0",
Additional context
No response
Activity
github-actions commentedon May 21, 2026
We noticed that you did not provide a StackBlitz or Bolt reproduction link. Please update the issue and add a link to a public project.
bolt-new-by-stackblitz commentedon May 21, 2026
sevenzing commentedon May 21, 2026
probably related issue: #2045
sevenzing commentedon May 21, 2026
@SamVerschueren could you please take a look?
SamVerschueren commentedon May 21, 2026
Hi @sevenzing! Thanks for reporting. A Google origin trial token has expired and we need to renew it. I flagged this internally as I'm not able to do this myself and will hopefully be fixed later today. I'll keep you posted.
sevenzing commentedon May 22, 2026
@SamVerschueren thanks a lot! The issue is still present, maybe it's possible to fix it before weekends? 👀
SamVerschueren commentedon May 22, 2026
Sorry, I forget to reach out again. The problem is... it looks like we are not able to solve this on our end.
So for embeds, we relied on the
UnrestrictedSharedArrayBufferorigin trial from Chrome to allow usage ofSharedArrayBuffer. This allowed anyone who embedded a WebContainer project to just run it without having to jump all the hoops to get cross origin isolation working. You can read more about what it is and in a blogpost I write a couple years ago.HOWEVER, since the 18th of May they apparently stopped the origin trial which means we cannot used
SharedArrayBufferanymore without proper cross origin isolation.I might need to digg a bit deeper to see if there's a way to solve this without jumping through all the hoops because that would mean it's up to the embedder to do all the hard work.
sevenzing commentedon May 22, 2026
@SamVerschueren
Can we somehow quickfix it on our end? For example send some header? I already tried it locally but did not succeed. Temp dirty solution is OK for us
sevenzing commentedon May 25, 2026
hey @SamVerschueren ! sorry for annoying pings 🥲
As I understood this issue wont have a quick fix on your side since Chrome dropped origin trial 😠 Does it mean that there is no way to fix it and embedded window simply wont work anymore?
Maybe there a way to quickly solve it on our end? As I said we can implement temp dirty solution 🙏
ddubrava commentedon May 25, 2026
Hey! Thanks for digging into this. I experience the same issue here - https://ddubrava.github.io/angular-yandex-maps/#/v3/components/YMapComponent
SamVerschueren commentedon May 27, 2026
No update on my side yet. I was out for a couple of days and now discussing internally on how to proceed here. Sorry for the delays but I'm trying to push for a solution.
SamVerschueren commentedon May 27, 2026
I looked at it again and actually it might already work if you want.
The StackBlitz SDK supports the option
crossOriginIsolated: truestarting from version 1.11.0. This serves the page with 3 extra headerscross-origin-embedder-policy: credentiallesscross-origin-opener-policy: same-originThis means that you also need to set the following headers on the top level page
cross-origin-embedder-policy: credentiallesscross-origin-opener-policy: same-originIf you don't use the SDK but just embedding with the embed url, you can just add
corp=1to the embed URL.You also need to allow cross origin isolation in the iframe
Please test this out and let me know.
[EDIT]: You should make sure to upgrade the SDK to version 1.11.1.
9 remaining items
alexovn commentedon Jun 13, 2026
@SamVerschueren I have same error. I tried to add
corp=1to the embed URL andallow="cross-origin-isolated"attribute to iframe, but nothing works. There's a problem with fetchinghttps://json.schemastore.org/packageandhttps://json.schemastore.org/prettierrcrequests.sevenzing commentedon Jun 17, 2026
@SamVerschueren yes, I'm using latest 1.11.0
Updates from my side:
/run/endpoint, this is strange:Application > Frames > runBut now when I paste this iframe I also get
Unable to run Embedded Project, mysterioussevenzing commentedon Jun 25, 2026
@SamVerschueren 👀
SamVerschueren commentedon Jul 1, 2026
@sevenzing I don't see the
corp=1flag in the run endpoint you are calling? Am I missing something here? I also don't see the query param in the requests made on https://ensnode.io/docs/integrate/integration-options/enskit/example.@alexovn The failures on schemastore is not something we can do, it's because schemastore.org doesn't serve the correct headers.
Sorry about the inconvenience here. I'm juggling multiple things.
SamVerschueren commentedon Jul 1, 2026
@sevenzing I think I found the root cause. I'll let you know when I released a new version of the SDK.
SamVerschueren commentedon Jul 2, 2026
@sevenzing Can you update to the latest
@stackblitz/sdkversion1.11.1and test again?alexovn commentedon Jul 2, 2026
Okay, I got it. But can we ignore schemastore.org? Otherwise, it looks like no example that has been embedded will work
SamVerschueren commentedon Jul 3, 2026
Yes, I believe you can ignore it. I think they get loaded in order to get some code completion in
package.jsonfor known attributes. If they fail to load, you don't get auto completion, but that's fine. It does not prevent it from running.alexovn commentedon Jul 3, 2026
It's strange, 'cause I see that it may prevent loading a nested StackBlitz browser's example. I don't see any other purposes for this issue
johnhwhite commentedon Jul 14, 2026
We hit this issue when using the legacy, WebPack-based Angular dev-server in a webcontainer, and switching to the application builder also added the
Cross-Origin-Resource-Policyheader necessary to work in the webcontainer on StackBlitz.Our case was using
openProjectand not embedded projects, but adding the comment in case it helps others who encounter this issue.fix(components/docs-tools): code examples in StackBlitz WebContainer …
chore: release 14.6.2 (#4518)
fix(components/docs-tools): code examples in StackBlitz WebContainer …
chore: release 15.0.0-alpha.1 (#4480)
banzor commentedon Sep 3, 2026
We are experiencing this same issue. I tried adding the headers to our host page and adding the attributes to the iframe tag. Nothing is solving it.
I have embedded a few different stackblitz samples in tutorials on our documentation site. Recently, they have become unable to render.
See embed here:
https://developer.mescius.com/spreadjs/docs/tutorials/how-to-import-and-export-excel-xlsx-using-javascript
Sample here:
https://stackblitz.com/edit/spreadjs-import-export-excel
Error message:
Unable to run Embedded Project
Looks like this project is being embedded without proper isolation headers.
Using iframe to embed. These have worked for a long time but broke suddenly.