Per-instance BrowserSource Chromium Flags #77

New issue

Open

opened 2017-05-01 06:50:18 -05:00 by SReject · 1 comment

SReject commented

2017-05-01 06:50:18 -05:00

(Migrated from github.com)

I know that you can pass flags to the Chromium instance via opening obs with them but this isn't ideal from a security standpoint.

My current use case is I have two BrowserSource instances, one for a local page that can be whole-heartedly trusted while another, which points to a remote site, that can't be. I'd like to be able to pass the --disable-web-security flag to the local-page's instance, while the remote-page instance would still enforce such.

I'd suggest an additional input box for specifying flags below the custom CSS input.

I know that you can pass flags to the Chromium instance via opening obs with them but this isn't ideal from a security standpoint. My current use case is I have two BrowserSource instances, one for a local page that can be whole-heartedly trusted while another, which points to a remote site, that can't be. I'd like to be able to pass the `--disable-web-security` flag to the local-page's instance, while the remote-page instance would still enforce such. I'd suggest an additional input box for specifying flags below the custom CSS input.

👍 3

dori4n commented

2018-12-24 14:16:26 -06:00

(Migrated from github.com)

I'd like to be able to pass the --disable-web-security flag to the local-page's instance

This is unnecessary, and a really bad idea.
See more about how easy it is to do this properly here: Chromium Security: Testing Powerful Features

PS: I would strongly suggest making a secure origin context mandatory, or not loading the page in the browser source at all, replacing the source texture output with an image which appropriately explains this, and not letting users disable it, ever.

> I'd like to be able to pass the `--disable-web-security` flag to the local-page's instance This is unnecessary, and [a really bad idea](https://games.greggman.com/game/dont-disable-web-security/). See more about how easy it is to do this properly here: [Chromium Security: Testing Powerful Features](https://sites.google.com/a/chromium.org/dev/Home/chromium-security/deprecating-powerful-features-on-insecure-origins#TOC-Testing-Powerful-Features) PS: I would strongly suggest making a secure origin context mandatory, or not loading the page in the browser source at all, replacing the source texture output with an image which appropriately explains this, and not letting users disable it, ever.

👎 3

No milestone

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

gh-obsproject/obs-browser#77

No description provided.

Rows
Columns