[blazor] Set Cross-Origin-Policy headers for multi-threaded runtime (#47855)

* Apply COP headers on .js and fallback index.html on the DevServer

* Copy the --apply-cop-headers to the inner loop targets

Author: maraf

src/Components/Directory.Build.targets

@@ -9,7 +9,8 @@
 
     <_BlazorDevServerPath>$(ArtifactsDir)bin/Microsoft.AspNetCore.Components.WebAssembly.DevServer/$(Configuration)/$(DefaultNetCoreTargetFramework)/blazor-devserver.dll</_BlazorDevServerPath>
     <RunCommand>dotnet</RunCommand>
-    <RunArguments>exec &quot;$(_BlazorDevServerPath)&quot; --applicationpath &quot;$(TargetPath)&quot; $(AdditionalRunArguments)</RunArguments>
+    <_RunExtraArguments Condition="'$(WasmEnableThreads)' == 'true'">--apply-cop-headers</_RunExtraArguments>
+    <RunArguments>exec &quot;$(_BlazorDevServerPath)&quot; --applicationpath &quot;$(TargetPath)&quot; $(_RunExtraArguments) $(AdditionalRunArguments)</RunArguments>
   </PropertyGroup>
 
   <ItemGroup>

src/Components/WebAssembly/DevServer/src/Server/Program.cs

@@ -35,6 +35,7 @@ public static IHost BuildWebHost(string[] args) =>
                     ["Logging:LogLevel:Microsoft"] = "Warning",
                     ["Logging:LogLevel:Microsoft.Hosting.Lifetime"] = "Information",
                     [WebHostDefaults.StaticWebAssetsKey] = name,
+                    ["ApplyCopHeaders"] = args.Contains("--apply-cop-headers").ToString()
                 };
 
                 config.AddInMemoryCollection(inMemoryConfiguration);

src/Components/WebAssembly/DevServer/src/Server/Startup.cs

@@ -29,6 +29,26 @@ public static void Configure(IApplicationBuilder app, IConfiguration configurati
 
         app.UseWebAssemblyDebugging();
 
+        bool applyCopHeaders = configuration.GetValue<bool>("ApplyCopHeaders");
+
+        if (applyCopHeaders)
+        {
+            app.Use(async (ctx, next) =>
+            {
+                if (ctx.Request.Path.StartsWithSegments("/_framework") && !ctx.Request.Path.StartsWithSegments("/_framework/blazor.server.js") && !ctx.Request.Path.StartsWithSegments("/_framework/blazor.web.js"))
+                {
+                    string fileExtension = Path.GetExtension(ctx.Request.Path);
+                    if (string.Equals(fileExtension, ".js"))
+                    {
+                        // Browser multi-threaded runtime requires cross-origin policy headers to enable SharedArrayBuffer.
+                        ApplyCrossOriginPolicyHeaders(ctx);
+                    }
+                }
+
+                await next(ctx);
+            });
+        }
+
         app.UseBlazorFrameworkFiles();
         app.UseStaticFiles(new StaticFileOptions
         {
@@ -41,7 +61,17 @@ public static void Configure(IApplicationBuilder app, IConfiguration configurati
 
         app.UseEndpoints(endpoints =>
         {
-            endpoints.MapFallbackToFile("index.html");
+            endpoints.MapFallbackToFile("index.html", new StaticFileOptions
+            {
+                OnPrepareResponse = fileContext =>
+                {
+                    if (applyCopHeaders)
+                    {
+                        // Browser multi-threaded runtime requires cross-origin policy headers to enable SharedArrayBuffer.
+                        ApplyCrossOriginPolicyHeaders(fileContext.Context);
+                    }
+                }
+            });
         });
     }
 
@@ -69,4 +99,10 @@ private static void EnableConfiguredPathbase(IApplicationBuilder app, IConfigura
             });
         }
     }
+
+    private static void ApplyCrossOriginPolicyHeaders(HttpContext httpContext)
+    {
+        httpContext.Response.Headers["Cross-Origin-Embedder-Policy"] = "require-corp";
+        httpContext.Response.Headers["Cross-Origin-Opener-Policy"] = "same-origin";
+    }
 }

src/Components/WebAssembly/DevServer/src/build/Microsoft.AspNetCore.Components.WebAssembly.DevServer.targets

@@ -2,6 +2,7 @@
   <PropertyGroup>
     <_BlazorDevServerDll>$(MSBuildThisFileDirectory)../tools/blazor-devserver.dll</_BlazorDevServerDll>
     <RunCommand>dotnet</RunCommand>
-    <RunArguments>&quot;$(_BlazorDevServerDll)&quot; --applicationpath &quot;$(TargetPath)&quot;</RunArguments>
+    <_RunExtraArguments Condition="'$(WasmEnableThreads)' == 'true'">--apply-cop-headers</_RunExtraArguments>
+    <RunArguments>&quot;$(_BlazorDevServerDll)&quot; --applicationpath &quot;$(TargetPath)&quot; $(_RunExtraArguments)</RunArguments>
   </PropertyGroup>
 </Project>