Using express is a (potential and unnecessary) security issue about remix-electron HOT 3 CLOSED

Thanks for bringing this up. I've never used this protocol API before, but I'll try to see if I can get it working. PRs or example implementations are also welcome 🙂

from remix-electron.

I'll give some background as well: The goal here was to allow the usage of remix's loader and action APIs as a cleaner alternative to the usual electron techniques, e.g. IPC messaging and preload files. To my knowledge, that requires some sort of server process, hence the node server.

I've seen the suggestion of loading the files statically via loadFile, but Remix is server-first; there is no static index.html file to load. Our content has to come from a server.

As I understand, the security issue is the node server listening on an open port, so we'll avoid that.

The problem to solve now is how to make a "fake request" to the express app that Remix runs on. Blanking out on a few pieces here:

async function main() {
  await app.whenReady()
  win = new BrowserWindow()
  
  win.loadURL(/* ??? */)

  protocol.interceptHttpProtocol("http", (request, callback) => {
    /* ??? */
  })
}

Or maybe there's some other completely different approach I haven't thought of 🤷 Either way, that's where I'm at.

from remix-electron.

I dug further, and Remix actually exposes apis for handling custom-crafted requests. I used that to send responses from an interception, and that seems to mostly work, but still need to fix some kinks with the setup. Here's the PR for it #2

from remix-electron.