Windowscommunitytoolkit: WebView Cannot Navigate to Localhost/Intranet Locations

[dckorben]

I'm submitting a...Bug report (I searched for similar issues and did not find one)

Current behavior

Navigating to a localhost or intranet webserver location with or without a port does not work. No errors. Blank rendering. Same location works in Edge directly.

Expected behavior

The hosted browser control should to be able to open & render intranet or localhost sites just like it is able to successfully open remote sites.

Minimal reproduction of the problem with instructions

Create New WPF App, Add WebView with Source of a local intranet or localhost webserver. No rendering

Environment

Nuget Package(s):
Microsoft.Toolkit.Win32.UI.Controls 3.0

Package Version(s):
Windows 10 Build Number:

• [ ] Creators Update (15063)
• [ ] Fall Creators Update (16299)
• [X] April 2018 Update (17134)
• [ ] Insider Build (build number: )

App min and target version:

• [ ] Creators Update (15063)
• [ ] Fall Creators Update (16299)
• [X] April 2018 Update (17134)
• [ ] Insider Build (xxxxx)

Device form factor:

• [X] Desktop
• [ ] Mobile
• [ ] Xbox
• [ ] Surface Hub
• [ ] IoT

Visual Studio

• [X] 2017 (version: 15.7.3 )
• [ ] 2017 Preview (version: )

[rjmurillo]

@dckorben Did you set the IsPrivateNetworkClientServerCapabilityEnabled property to true?

[dckorben]

That was the issue. Thanks.

[dckorben]

To follow up, this definitely solves the intranet sites issue. However, it does not appear to solve a localhost target.

[rjmurillo]

You can try adding a loopback exemption with checknetisolation LoopbackExempt -a -n=Microsoft.Win32WebViewHost_cw5n1h2txyewy. See https://msdn.microsoft.com/en-us/library/windows/apps/hh780593.aspx for more info

[dckorben]

The loopback exemption fixed the localhost issue and the link referenced is basically the workflow I'm dealing with, dev and webserver on same box. I'm glad to have Edge hostable in such an direct manner. This issue should be closed as all of the concerns have been resolved.

[GaelGirodon]

Is it possible to allow localhost access without having to set a loopback exemption (this can’t be done on each computer where the application will be installed)?

If I understand well, there’s a security reason to forbid UWP applications to send network traffic to the local computer. But, imagine we need, for prototyping purposes, to build an Electron-like application with a .NET/WPF/WebView/Edge stack displaying our web application (locally served). The old WebBrowser control was able to display a local website. Is it possible to get the same behaviour with the brand new WebView?

I didn’t want to open a new issue because the problem is still the same (but I can open one if you prefer).

[rjmurillo]

Unfortunately the exemption is a requirement since the web view process hosting Edge for Win32 is UWP. This was not necessary for the WebBrowser control since it was hosted in the same process as your Win32 application and would be unaware of the UWP sandbox if it were running with Desktop Bridge.

[GaelGirodon]

Thank you very much for your quick reply and for this explanation. I think that using the WebView control for my project is not the right solution. I will continue to look for something that is more suited to my use case.

[dotMorten]

@rjmurillo Why isn't this defaulting to true? It feels odd to have this limitation in a desktop app, and it seems to be coming up many times baffling users.

[rjmurillo]

@dotMorten The short answer is it's a security feature from the WIndows 8 metro AppContainer system to sandbox application that's also present in UWP. It was designed in this case to ward off port scanning and cross-site-request forgery attacks.

Edit (to actually answer the question): the most secure value is the default, which is false. Developers who are willing to take the risk can set to true to remove privateNetworkClientServer restriction.

CC @joshholmes

[dotMorten]

@rjmurillo oh I get that, but does any of that really make sense in a desktop app? I mean what risk are they running that they weren't already running in a desktop app?

[rjmurillo]

@dotMorten Versus WebBrowser/Trident? It's a fair point. The default for the underlying WinRT control is still false but we could make it friendlier for the toolkit by making it true by default for our implementations.

Edit: clarity on the control

[JohnGalt1717]

how does one put in the exemption when using webview or webviewcompatible with WPF?

[AliFlux]

Hi. Is there a better way to add a loopback exemption? I'm creating a Win32 application for mass distribution and running this command on each executable doesn't seem like the right thing to do.

[JohnGalt1717]

@AliFlux Best solution I've found is to use ngrok.

[AliFlux]

I'm working on an offline application :( Can't use ngrok

[AliFlux]

I ended up using CefSharp. Their WPF control, although powerful, is a bit sluggish.

[scegg]

@dckorben Did you set the IsPrivateNetworkClientServerCapabilityEnabled property to true?

But while setting this, an exception will be raised:
System.Resources.MissingManifestResourceException: 'Could not find any resources appropriate for the specified culture or the neutral culture. Make sure "Microsoft.Toolkit.Win32.UI.Controls.DesignerUI.resources" was correctly embedded or linked into assembly "Microsoft.Toolkit.Forms.UI.Controls.WebView" at compile time, or that all the satellite assemblies required are loadable and fully signed.'

Windows 10 Enterprise 1903 with VS 2019, Winform, netfx 4.8

[Tom2690]

I am getting the exact same problem as scegg. Windows 10 Version 10.0.18362 Build 18362
Visual Studios 2019 Winform .net version 4.8.03752
Also properties will sometime show, sometimes crash VS. Events will never show and ALWAYS crash VS. If I code
webView1.IsPrivateNetworkClientServerCapabilityEnabled = true;
I get the error
System.Resources.MissingManifestResourceException: 'Could not find any resources appropriate for the specified culture or the neutral culture. Make sure "Microsoft.Toolkit.Win32.UI.Controls.DesignerUI.resources" was correctly embedded or linked into assembly "Microsoft.Toolkit.Forms.UI.Controls.WebView" at compile time, or that all the satellite assemblies required are loadable and fully signed.'

My only response from the developer was contact Visual Studios.