coder/code-server · error · Error

'crypto.subtle' is not available so webviews will not work.

Error message

'crypto.subtle' is not available so webviews will not work. This is likely because the editor is not running in a secure context (https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts).

What it means

Thrown by the webWorkerExtensionHostIframe.html (patched in webview.diff) when window.crypto.subtle is unavailable. crypto.subtle only exists in secure contexts (https or localhost), so the iframe that hosts the extension web worker cannot validate its parent origin and refuses to start. The message explicitly points to the MDN Secure Contexts documentation.

Source

Thrown at patches/webview.diff:77

 			const swPath = encodeURI(`service-worker.js?v=${expectedWorkerVersion}&vscode-resource-base-authority=${searchParams.get('vscode-resource-base-authority')}&remoteAuthority=${searchParams.get('remoteAuthority') ?? ''}&platform=${searchParams.get('platform')}`);
-			navigator.serviceWorker.register(swPath, { type: 'module', updateViaCache: 'none' })
+			navigator.serviceWorker.register(swPath)
 				.then(async registration => {
 					if (navigator.serviceWorker.controller) {
 						// A previous SW is already controlling. Force an update
@@ -332,6 +332,12 @@
 
 				const hostname = location.hostname;
 
+				// It is safe to run if we are on the same host.
+				const parent = new URL(parentOrigin)
+				if (parent.hostname === hostname) {
+					return start(parentOrigin)
+				}
+
 				if (!crypto.subtle) {
 					// cannot validate, not running in a secure context
 					throw new Error(`'crypto.subtle' is not available so webviews will not work. This is likely because the editor is not running in a secure context (https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts).`);
Index: code-server/lib/vscode/src/vs/workbench/services/extensions/worker/webWorkerExtensionHostIframe.html
===================================================================
--- code-server.orig/lib/vscode/src/vs/workbench/services/extensions/worker/webWorkerExtensionHostIframe.html
+++ code-server/lib/vscode/src/vs/workbench/services/extensions/worker/webWorkerExtensionHostIframe.html
@@ -34,6 +34,13 @@
 			}
 			return start();
 		}
+
+		// It is safe to run if we are on the same host.
+		const parent = new URL(parentOrigin)
+		if (parent.hostname === hostname) {
+			return start()
+		}
+
 		if (!crypto.subtle) {
 			// cannot validate, not running in a secure context
 			return sendError(new Error(`Cannot validate in current context!`));

View on GitHub (pinned to 51f90a376b)

Solutions

1. Serve code-server over HTTPS (terminate TLS at the reverse proxy with a valid cert), which makes crypto.subtle available.
2. Access via http://localhost (localhost is treated as a secure context) for local development.
3. Ensure the reverse proxy forwards the correct scheme so the browser sees https.
4. Confirm the parent and iframe hostnames match so the same-host short-circuit in webview.diff can skip the crypto check.

Example fix

# Serve over TLS so the browser is in a secure context
caddy reverse-proxy --from editor.example.com --to localhost:8080
# or use http://localhost:8080 for local-only access

// Detect a secure context before relying on crypto.subtle.
function canUseWebviews(): boolean {
  return typeof crypto !== 'undefined' && typeof crypto.subtle !== 'undefined'
}
if (!canUseWebviews()) console.warn('Serve over HTTPS or use localhost for webviews')

function isSecureContext(): boolean {
  return typeof crypto !== 'undefined' && typeof crypto.subtle !== 'undefined'
}

try {
  startExtensionHost()
} catch (e) {
  if (/crypto.subtle.*not available/.test(e.message)) {
    showUserError('Reopen over HTTPS or http://localhost to enable webviews')
  }
}

When it happens

Trigger: Loading code-server over plain http from a non-localhost host (e.g. http://10.0.0.5:8080), which is not a secure context, so crypto.subtle is undefined. The new same-host short-circuit added by webview.diff does not apply because the parent origin check happens before this throw only when hostnames match; otherwise the secure-context guard fires.

Common situations: Deploying code-server behind plain HTTP on a LAN/remote host without TLS; a reverse proxy terminating TLS but the browser still sees http due to misconfigured forwarding; accessing via an IP instead of localhost on http; an older browser without SubtleCrypto.

Related errors

• --cert-key is missing
• Missing web configuration element
• isEnabledFileDownloads was not provided to the browser
• isEnabledFileUploads was not provided to the browser
• isEnabledCoderGettingStarted was not provided to the browser

AI-assisted analysis of coder/code-server@51f90a376b (2026-08-12). Data as JSON: /api/errors/0750bfd834036f8c. Report an issue: GitHub.