Skip to content

Conversation

@adamziel
Copy link
Collaborator

@adamziel adamziel commented Nov 14, 2025

Motivation for the change, related issues

I've noticed fetchWithCorsProxy sometimes fails when it gets an http URL. Since browsers frown upon http fetches in https context, this PR enforces HTTPS as a protocol in those requests to resolves the following error:

fetch-with-cors-proxy.ts:41 Mixed Content: The page at 'https://playground.wordpress.net/playground-worker-endpoint-blueprints-v1-8WcTNDgf.js' was loaded over HTTPS, but requested an insecure resource 'http://myresource.com'. This request has been blocked; the content must be served over HTTPS.

Testing Instructions (or ideally a Blueprint)

CI, new test is shipped with this PR.

@adamziel
Copy link
Collaborator Author

@copilot run HTTPS server in packages/php-wasm/web/src/lib/tcp-over-fetch-websocket.spec.ts, HTTP server won't cut it anymore. Make sure the OS trusts the certificate.

Copy link
Contributor

Copilot AI commented Nov 14, 2025

@adamziel I've opened a new pull request, #2903, to work on those changes. Once the pull request is ready, I'll request review from you.

…2903)

## Motivation for the change, related issues

`fetchWithCorsProxy` now upgrades HTTP URLs to HTTPS. Tests making
requests to `http://127.0.0.1:PORT` get upgraded to
`https://127.0.0.1:PORT`, requiring an HTTPS test server.

## Implementation details

**Test server migration to HTTPS**
- Generate self-signed certificates with SANs for `127.0.0.1` using
`selfsigned` library
- Convert Express server from `app.listen()` to `https.createServer()`
- Set `NODE_TLS_REJECT_UNAUTHORIZED=0` for test environment

**Fix request body stream handling**
- `cloneRequest()` was calling `await request.blob()` to clone requests
with bodies
- This hung on POST requests because the body stream was still awaiting
data that would never arrive
- Solution: Reuse unconsumed body streams directly via `request.body`
instead of reading to Blob

```typescript
// Before: Hangs when body stream is still open
const body = await request.blob();

// After: Reuses stream when possible
const body = !request.bodyUsed && request.body 
  ? request.body 
  : await request.blob();
```

- Added `duplex: 'half'` to Request creation for Node.js streaming body
compatibility
- Removed unused `@ts-expect-error` directive as TypeScript now properly
recognizes the `duplex` property

## Testing Instructions (or ideally a Blueprint)

CI. All 31 tests in `tcp-over-fetch-websocket.spec.ts` pass, including
POST requests with bodies.

<!-- START COPILOT CODING AGENT TIPS -->
---

✨ Let Copilot coding agent [set things up for
you](https://github.com/WordPress/wordpress-playground/issues/new?title=✨+Set+up+Copilot+instructions&body=Configure%20instructions%20for%20this%20repository%20as%20documented%20in%20%5BBest%20practices%20for%20Copilot%20coding%20agent%20in%20your%20repository%5D%28https://gh.io/copilot-coding-agent-tips%29%2E%0A%0A%3COnboard%20this%20repo%3E&assignees=copilot)
— coding agent works faster and does higher quality work when set up for
your repo.

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: adamziel <205419+adamziel@users.noreply.github.com>
Co-authored-by: Adam Zieliński <adam@adamziel.com>
@adamziel adamziel changed the title [Website] Keep fetch-with-cors-proxy on HTTPS paths [Website] Enforce HTTPS in fetchWithCorsProxy() Nov 18, 2025
@adamziel adamziel marked this pull request as ready for review November 18, 2025 11:31
@adamziel adamziel merged commit 1b2efd1 into trunk Nov 18, 2025
32 checks passed
@adamziel adamziel deleted the enforce-https-in-cors-proxy branch November 18, 2025 12:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants