GUgulgdev·Mar 28, 2025Submission
Ask HN: A new approach to JavaScript sandboxing
Hello, HN! I wanted to share my thoughts about sandboxing and ask for an advice.
I've been developing and researching JS sandboxes for several years now, because all existing solutions that I've found aren't the ones that I need.
I am working on a project that allows devs to easily develop multiplayer web-games and host them for free. Som I need a sandbox that would both provide great security and good experience for developers. I've been using SES (https://github.com/endojs/endo/tree/master/packages/ses), but there's a problem in this approach: while it is very good for securing your application, it doesn't really provide a good developing experience because a lot of JS projects don't like being in such a restricted environment (SES freezes all globals and intrinsics). After doing some research, I've concluded that most of the web sandbo
Read the rest
xes use one of the following approaches: they either use a WebWorkers or sandboxed iframes. That sounds good but both approaches have their downsides.
When you use WebWorkers, you can't really provide an API to a developer, because the only way you can communicate with a WebWorker is by using postMessage. While you could inject a host code that would wrap postMessage function to create some good-looking API, it isn't possible to make something advanced, because of the prototype injection.
With iframes, you can inject your API safely into contentWindow, by wrapping it using iframe's realm intrinsics. But iframes can freeze the whole app, for example, by creating an infinite loop. There's also OOPIF but they have the same problem as WebWorkers.
So, I came up with an idea that sort of combines the two approaches by creating a separate process with multiple realms in it. Sadly, there's no way to create a new ES realm in a WebWorker, so I'm bound to using OOPIFs. The current architecture is inspired by Electron's process model (https://www.electronjs.org/docs/latest/tutorial/process-model): the app that uses sandboxing creates a new process (box) and specifies a script that would be ran in that process (host script). That script can communicate with the main app and access a separate realm (user world) and inject it's API into it.
However, while implementing this kind of sandbox, I came across one big downside: it's hard to deploy an app that uses this sandboxing method, because it requires the use of out-of-process iframes, which must be cross-origin to be places in a separate process. So, I can't, for example, create a demo on GH pages. And I wanted to ask, is there a way to create an out-of-process iframe without requiring the server to serve the HTML file from a different subdomain? I've looked into using ServiceWorkers with Origin-Agent-Cluster header, but it didn't really work. Thanks!
P.S. This is my first post on HN, idk if this is the right place to ask