Allow WebSocket requests over the network #538

Merged

WizardCM merged 1 commit from allow-websocket into master

2026-09-15 15:40:08 -05:00

WizardCM commented

2026-09-12 00:54:35 -05:00

(Migrated from github.com)

Description

Well this solution ended up being different than I expected.

I had previously prepared github.com/WizardCM/obs-browser@4c65eaaf40 which would show a permission request dialog.
However, in my testing today, this dialog does not get triggered for a website attempting to access the local network for WebSockets, at least on CEF 150. Neither OnRequestMediaAccessPermission nor OnShowPermissionPrompt get called.

This is strange, because on a shipping version of Google Chrome, a permission dialog is displayed, and clicking Allow enables the connection. Further digging is required but is not a blocker for this PR.

The flow in CEF works like so

Microphone/Webcam permissions go through OnRequestMediaAccessPermission
Most other permissions go through OnShowPermissionPrompt
Local network WebSocket is tied to github.com/chromium/chromium@8408977/services/network/public/cpp/features.cc (L273-L279)

Webcam and Microphone seem to continue to work via --enable-media-stream per this documentation, which I have verified is true. This behaviour is unchanged before or after this PR.

With Alloy style, default handling will deny the request. This method will not be called if the --enable-media-stream command-line switch is used to grant all permissions.

Motivation and Context

Retain pre-Chrome-runtime behaviour for all permissions (for now). In this case, the ability for a browser source or dock's webpage to make outgoing WebSocket requests.

Fixes ERR_BLOCKED_BY_LOCAL_NETWORK_ACCESS_CHECKS

We do not want to provide regressions while a better solution is devised.

At the same time, we also don't want to open too many security holes by using broad toggles.

How Has This Been Tested?

Launch with CEF 150 on Windows pointed to https://obs.wesbos.com/

Attempt to log in.

Types of changes

Tweak (non-breaking change to improve existing functionality)

Checklist:

I have read the contributing document.
My code has been run through clang-format.
My code follows the project's style guidelines
My code is not on the master branch.
My code has been tested.
All commit messages are properly formatted and commits squashed where appropriate.
I have included updates to all appropriate documentation.

### Description Well this solution ended up being different than I expected. I had previously prepared https://github.com/WizardCM/obs-browser/commit/4c65eaaf4044240f16e15a0258db3023b79945d7 which would show a permission request dialog. However, in my testing today, this dialog **does not** get triggered for a website attempting to access the local network for WebSockets, at least on CEF 150. **Neither** `OnRequestMediaAccessPermission` nor `OnShowPermissionPrompt` get called. This is strange, because on a shipping version of Google Chrome, a permission dialog is displayed, and clicking Allow enables the connection. **Further digging is required but is not a blocker for this PR.** The flow in CEF works like so * Microphone/Webcam permissions go through `OnRequestMediaAccessPermission` * Most other permissions go through `OnShowPermissionPrompt` * Local network WebSocket is tied to https://github.com/chromium/chromium/blob/8408977/services/network/public/cpp/features.cc#L273-L279 Webcam and Microphone seem to continue to work via `--enable-media-stream` per [this documentation](https://cef-builds.spotifycdn.com/docs/150.0/classCefPermissionHandler.html#a05723b8cdd0a3f410ea52d05e2a41e16), which I have verified is true. This behaviour is unchanged before or after this PR. > With Alloy style, default handling will deny the request. This method will not be called if the `--enable-media-stream` command-line switch is used to grant all permissions. ### Motivation and Context Retain pre-Chrome-runtime behaviour for all permissions (for now). In this case, the ability for a browser source or dock's webpage to make outgoing WebSocket requests. Fixes `ERR_BLOCKED_BY_LOCAL_NETWORK_ACCESS_CHECKS` We do not want to provide regressions while a better solution is devised. At the same time, we also don't want to open too many security holes by using broad toggles. ### How Has This Been Tested? Launch with CEF 150 on Windows pointed to `https://obs.wesbos.com/` Attempt to log in. ### Types of changes - Tweak (non-breaking change to improve existing functionality) ### Checklist: - [x] I have read the [**contributing** document](https://github.com/obsproject/obs-studio/blob/master/CONTRIBUTING.md). - [x] My code has been run through [clang-format](https://github.com/obsproject/obs-studio/blob/master/.clang-format). - [x] My code follows the project's [**style guidelines**](https://github.com/obsproject/obs-studio/blob/master/CODESTYLE.md) - [x] My code is not on the master branch. - [x] My code has been tested. - [x] All commit messages are properly formatted and commits squashed where appropriate. - [x] I have included updates to all appropriate documentation.

❤️ 1

Warchamp7 (Migrated from github.com) approved these changes

2026-09-14 18:36:25 -05:00

Warchamp7 (Migrated from github.com) left a comment