[BUG] [Wasm] [Security] Changing `Unsave Contents` from Block to allow shows js script and a before "safe" side is afterwards marked as unsafe while its https

[DevTKSS]

Description

Current behavior 🐛

First time this is happening like this, and it seems to be presenting different than the known https error 🤔 so maybe someone knows something about that and can tell me more about this:

• If we do update the Unsafe Contents from Block to Allow, while running the WebAssembly Project itself (not Server as startup!), a Banner below the Url Headline of chrome browser does show up suggesting to refresh the page to apply that setting change
• Normally this does fine, when the server is the startup, but as I done this on WebAssembly Project now, I got thrown(?) into the js script window you can see in repro steps

Expected behavior 🎯

What we have:

• It's absolutly okay that we need to set "Unsafe Contents" to Allow 👍
• the https run of wasm target (app, non server) works fine with this launchsettings.json profile: 👍

  {
    "iisSettings": {
      "windowsAuthentication": false,
      "anonymousAuthentication": true,
      "iisExpress": {
        "applicationUrl": "http://localhost:8080",
        "sslPort": 0
      }
    },
    "profiles": {
      // This profile is first in order for dotnet run to pick it up by default
      "UnoApp5 (WebAssembly)": {
        "commandName": "Project",
        "dotnetRunMessages": true,
        "launchBrowser": true,
        "applicationUrl": "https://localhost:5001;http://localhost:5000",
        "inspectUri": "{wsProtocol}://{url.hostname}:{url.port}/_framework/debug/ws-proxy?browser={browserInspectUri}",
        "environmentVariables": {
          "ASPNETCORE_ENVIRONMENT": "Development"
        }
      },

• Our App is starting with "safe content" left of url 👍

What we should have ALSO:

• After updating the reqired setting, we should still have that "safe content" label instead of the opposite 🤔
• We should not get redirected to the js file on Browser "refresh to apply changes" 🤔

Steps to Reproduce

• UnoApp5 (2).zip

• Startup Proj is the regular Uno App targeting WebAssembly (not the server) and for the 5001 port in https the Unsafe Contents Setting is still set to Block before you start this

• showing that we are safe on this address 🤔 while we seem to have no permission to go to our Login screen:
  
  (which is caused from our not allow on unsafe contents I would assume)

• Now as we know, that we need to update and check this, we allow them here instead of block as default 👍
  

• returning to the tab of https, we are getting suggested that we want to update to apply the settings update:
  

• Clicking on "Refresh" (or whatever the button says on Englisch) ;)
  
  (recognize that we did not got any Error Pop Up or Exception Flyout like normally in VS2022 🤔
  this is the full (file?) name of that shown code:
  
  not sure, what exactly this Line should show me, but if I check the value of the code, I do see "0" which normally means, something did exit (?)
  

• Okay now if I clicked on "continue" in my Ide, Suddenly my before all good and "safe" shown page stuck at our splash screen, now is marked as Unsafe, BUT Welcome in our actual app view!

checking the "unsafe" x on the top, does show me this:

but we are still on https, so we should be all fine from that: 🤔

Cookies should also be fine if we need some under the hood (do we?) 🤔

And the only Block Marked thing here is the "Intrusive Advertisements", so as far as I know of, we dont care about this for Wasm (?)

• This Behavior stays the same if we end and restart our wasm debug session:
  

Now comes the even stranger part 🤔

• That "unsafe contents" warning stays there, no matter what I did, UNTIL (for the repro) I did set the "unsafe contents" again back to "Block" 😧
• Restarting now, shows up that we are again all safe, BUT we are again stuck at our Splash Screen

😵‍💫

Platform with bug

WebAssembly

Affected platforms

WebAssembly with Server Project in Solution

Did you find any workaround?

🤔 we do know, that https is all fine and our unsafe contents is allowed... so we as devs know, thats good and we can enter our app fine and (hopefully) work as expected?
So maybe in this case, a possible workaround would be, to ignore that strange thing?

Relevant log output

here is our current output at the point we got the js script shown
Output-Debug.txt

and this has been added to the output (the first part you do know from the last output):
  
    The program 'siteDetails?site=https%3A%2F%2Flocalhost%3A5001 « JavaScript debug adapter' has exited with code 4294967295 (0xffffffff).
    Setting DOTNET_MODIFIABLE_ASSEMBLIES=debug
    Setting UNO_BOOTSTRAP_MONO_RUNTIME_MODE=Interpreter
    Setting UNO_BOOTSTRAP_MONO_PROFILED_AOT=False
    Setting UNO_BOOTSTRAP_LINKER_ENABLED=False
    Setting UNO_BOOTSTRAP_DEBUGGER_ENABLED=True
    Setting UNO_BOOTSTRAP_MONO_RUNTIME_CONFIGURATION=Release
    Setting UNO_BOOTSTRAP_MONO_RUNTIME_FEATURES=
    Setting UNO_BOOTSTRAP_APP_BASE=package_a33bdd8a65963822d1937a075761b3fe32673782
    Setting UNO_BOOTSTRAP_WEBAPP_BASE_PATH=/
    The thread '.NET TP Worker' (18464) has exited with code 0 (0x0).
    The thread '.NET TP Worker' (7012) has exited with code 0 (0x0).
    The thread '.NET TP Worker' (36528) has exited with code 0 (0x0).
    �[0m�[48;5;127m�[38;5;231mdotnet�[0m�[1m Loaded 101.78 MB resources�[0m
    This application was built with linking (tree shaking) disabled. 
    Published applications will be significantly smaller if you install wasm-tools workload. 
    See also https://aka.ms/dotnet-wasm-features�[0m
    Loaded 101.78 MB resources from cache
    Debugging hotkey: Shift+Alt+D (when application has focus)
    Active service worker found, skipping register
    Making persistent: /local
    Making persistent: /roaming
    Making persistent: /shared
    MONO_WASM: WebSocket error
    MONO_WASM: WebSocket error
    MONO_WASM: WebSocket error
    The thread '.NET TP Worker' (3916) has exited with code 0 (0x0).
    The thread '.NET TP Worker' (15356) has exited with code 0 (0x0).
    The thread '.NET TP Worker' (31348) has exited with code 0 (0x0).
    The thread '.NET TP Worker' (19144) has exited with code 0 (0x0).
    The thread '.NET TP Worker' (17672) has exited with code 0 (0x0).
    The thread '.NET TP Worker' (32504) has exited with code 0 (0x0).
    The thread '.NET TP Worker' (13284) has exited with code 0 (0x0).
    The thread '.NET TP Worker' (7036) has exited with code 0 (0x0).
    The thread '.NET TP Worker' (18700) has exited with code 0 (0x0).
    The thread '.NET TP Worker' (21824) has exited with code 0 (0x0).
    The thread '.NET TP Worker' (23276) has exited with code 0 (0x0).
    The thread '.NET TP Worker' (13868) has exited with code 0 (0x0).

Uno.Sdk version (and other relevant versions) 📦

6.1.23

IDE version 🧑‍💻

Visual Studio 17.14.9

Anything else we need to know? 💬

• I do not know anything about javascript, so I am looking for someone who might be able to tell me something about this and maybe can tell me what we can or should do when this happens.
• if our Startup is our WebAssembly and our Launchsettings are updated accordingly to the https setup guide of @jeromelaban do we maybe not need or should not even set this unsafe contents to allow? If so, that would be a good note to add if possible 👍

[DevTKSS]

• [Wasm] Changing Unsave Contents from Block to allow shows js script and a before "safe" side is afterwards marked as unsafe while its https unoplatform/uno#21143