Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Doesn't render with incognito window #2536

Closed
leesjensen opened this issue May 25, 2023 · 4 comments
Closed

Doesn't render with incognito window #2536

leesjensen opened this issue May 25, 2023 · 4 comments

Comments

@leesjensen
Copy link

This app doesn't render when I open it in an incognito window. No errors are displayed, and the iframe is empty.

Repo steps:

  1. Open an incognito window with the Chrome browser
  2. paste https://stackblitz.com/edit/stackblitz-starters-rgpcav in the URL bar.
  3. Observe: No content is rendered.
  4. Repeat steps 1 & 2 in a non-incognito window.
  5. Observe: Content is rendered.
@kc0tlh
Copy link
Collaborator

kc0tlh commented Aug 31, 2023

StackBlitz often does not work in incognito mode due to lack of 3rd party cookies, a required feature for us. See issue #162 for additional details.

@kc0tlh kc0tlh closed this as completed Aug 31, 2023
@leesjensen
Copy link
Author

@kc0tlh thanks for taking the time to respond. I read through #162 and didn't find a explanation as to why we have to reduce security in order for StackBlitz to work. What exactly is it about 3rd party cookies that is so important for an embedded sandbox to work?

@kc0tlh
Copy link
Collaborator

kc0tlh commented Sep 1, 2023

@leesjensen great question:

StackBlitz uses a combination of browser technologies, including Service Workers and WebAssembly, across several domains. Each running project has its own domain for the preview pane (custom_subdomain.webcontainers.io)and needs to install a Service Worker for that domain to work properly, while your browser tab is pointed at a different domain (stackblitz.com).

In some browsers, this feature is blocked by “third-party cookie” or “third-party storage” restrictions. These are legitimate restrictions when the third-party domain is an ad server or a tracking server, but in the case of StackBlitz projects the third-party domain is where your project code runs.

@leesjensen
Copy link
Author

That makes sense. Thanks for taking the time to respond.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants