quarto.js blocked by Cross origin requests policy when not previewing using web server

[cderv]

With the new way quarto.js works, and how in import tabset.js, Quarto will show console error about loading scripts when opening the HTML file, without having resource embeded.

Access to script at '(...)/index_files/libs/quarto-html/quarto.js' from origin 'null' has been blocked by CORS policy: Cross origin requests are only supported for protocol schemes: chrome, chrome-extension, chrome-untrusted, data, http, https, isolated-app.

This happens with Quarto 1.6.40 too.

quarto.js:1 Uncaught SyntaxError: Cannot use import statement outside a module

I am opening this issue in case anyone else is searching for this, as this is new starting from Quarto 1.6. Previously, opening from file system would work, but now, Quarto documents needs to be served (using quarto preview for example) so that they fully works. This was previously required only when using some JS tool that required server (like OJS)

I don't known if we can improve this somehow, but at least this should be documented somewhere... maybe in the FAQ. 🤔
This can be surprising to some users.

(I found this while looking at rich-iannone/DiagrammeR#519 (comment) where quarto preview does not work with some JS lib and opening from file system help)

[cscheid]

The only instance of this class of issues that we should fix is if it appears in the output of our email format. Anywhere else, we should not be trying to do it. It's not necessary (we have quarto preview on windows, and on Unix there's about 30 different ways of conveniently starting a local HTTP server). These restrictions exist for good reasons, and we should be slowly discouraging people from using file:// anyway.

[cderv]

These restrictions exist for good reasons, and we should be slowly discouraging people from using file:// anyway.

To be clear, I totally agree on this.

I feel this could raise question among prior R Markdown users used to open their file on disk. So I want to think on where to make that clear in our documentation.

[dmenne]

These restrictions exist for good reasons, and we should be slowly discouraging people from using file:// anyway.

For me, this is a killer that started with non-working grViz - no more Quarto. I send zipped/encrypted directories of a book to a customer and all I can expect is for them to unzip them. No one in pharma or medicine will accept a report on a website for security reasons, and very few will be willing to install a server to read a report.

Please, reconsider this lonely decision. Nobody expected after 15 years of knitr/rmarkdown/quarto

[cscheid]

Please, reconsider this lonely decision.

We can't. It's not up to our control. It is caused by our dependencies in a way that we cannot change.

[dmenne]

Do as some Hugo-Themes do: Provide a standalone subset with limited features.

[mcanouil]

See minimal: true https://quarto.org/docs/output-formats/html-basics.html#minimal-html

And you can opt-out for other features like code highlighting (Pandoc), etc.