I’m building one of these Podda [1], though pointed at households/small communities rather than companies, so ordinary people can keep the apps they’ve made by talking to Claude or ChatGPT and share them with their friends.

Passing code only the things it’s allowed to use works on the server because you start from zero, so our generated code holds no credentials at all and its only way out is a proxy that allows exact origins and methods.

You can’t really do that in the browser. CSP only restricts which origins the code can reach, not the method or the path, so approving one destination means anything the code can read can go anywhere there. The difficult part is that if we're writing an honest consent prompt to our users then it has to say that, and it sounds a lot worse than "allow network access?". This is hard especially when our target users are non/less-technical. There are other versions of the same problem everywhere, like revoking an origin not actually taking effect until a refresh.

[1] https://podda.app

▲

masterj an hour ago | parent [-]

For client side there is https://hardenedjs.org/

And Cloudflare OS does some fancy things with iframes + capnweb iirc

▲

william-evans an hour ago | parent [-]

Will take a deeper look into the Cloudflare OS source - thanks!

▲

kentonv an hour ago | parent [-]

We (Cloudflare OS) run an app's client-side code in a null-origin iframe sandbox that is denied access to everything that we can possibly deny access to. Its only communication line to the outside world is via a Cap'n Web RPC session over postMessage() to the parent frame, which in turn forwards the session on to the app's own server, which runs in a Dynamic Worker sandbox on its end. So the app client can only talk to the app server and nothing else.

Or at least, ideally. Unfortunately, content-security-policy today has a few exotic holes. WebRTC, for instance, cannot be blocked; the standard simply doesn't cover it.

So it's not suitable as a sandbox against malicious code trying to leak data by any means possible. Instead it's protection against the AI doing something stupid, perhaps prompted by a user who doesn't know better.

(We would love to get those CSP holes plugged, though...)

	▲	william-evans an hour ago \| parent [-]
		WebRTC is coming down the pipe into CSP hopefully soon: https://www.w3.org/TR/CSP3/#directives-other