Failed to execute 'postMessage' on 'Worker': SharedArrayBuffer transfer requires self.crossOriginIsolated.

[alejandrohdo]

Describe the bug

i have a problem in docker, any idea?
Failed to execute 'postMessage' on 'Worker': SharedArrayBuffer transfer requires self.crossOriginIsolated.

Link to the Bolt URL that caused the error

http://172.22.0.2:5173/chat/fastapi-token-auth

Steps to reproduce

this my promp:
hazme un api rest con fast Api que me permite levantar un servicicio con token, si solo me permita peticionar si el Token es OK, caso contrario rechazar las solicitudes

Expected behavior

only generate bug en docker

Screen Recording / Screenshot

No response

Platform

• OS: Linux 22.04
• Browser: Chrome 131.0.6778.139
• Version:

Provider Used

No response

Model Used

No response

Additional context

No response

[thecodacus]

not much idea on webcontainer on hosted version, it needs some extra configuration for shared array buffer and coep
maybe @wonderwhy-er or @aliasfoxkde can answer

[LfScOrPiO]

i have same problem

Failed to spawn bolt shell

Failed to execute 'postMessage' on 'Worker': SharedArrayBuffer transfer requires self.crossOriginIsolated.

[wonderwhy-er]

This error usually happens if you are serving from http or in some other cross domain cases.
Bolt uses webcontainers webassembly
For webpage and that to communicate efficiently one needs to use SharedArrayBuffer that is vulnerable to side channel attacks
Due to that it is subject to certain limitations

Conditions for SharedArrayBuffer to Work:
Secure Context: Your website must be served over HTTPS.
Cross-Origin Isolation: To ensure safe usage, your site needs to be cross-origin isolated. This is achieved by setting the following HTTP headers:
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
These headers help protect your site from potential cross-origin attacks by ensuring that it cannot share resources with other origins unless explicitly permitted.

https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/SharedArrayBuffer?utm_source=chatgpt.com#security_requirements

I can see that you are hosting it from http://172.22.0.2:5173/chat/fastapi-token-auth which is http

So I would look in that direction to fix.

I host it from cloudflare behind https so it works.
For local use its served from localhost which is exempt from this this requirements.

[rokipet]

Create a túnel from cloudfare to your host if using Linux and it works

[aliasfoxkde]

Create a túnel from cloudfare to your host if using Linux and it works

Likely because both are now using HTTPS/TLS and Cloudflare has a cert applied.