Update for Firefox users:
We’ve entered the Origin Trials for the Cross-Origin-Embedder-Policy: credentialless header. This means that game pages should now function as expected like they do on Chrome based browsers.
Tell us if you encounter any issues.
TL;DR: The token in the (“COEP: Credentialless”/CoepCredentialless feature) origin-trial header of itch.io appears to have expired at the end of 2023 and (presumably) needs to be regenerated.
Supposition: An expired origin-trial token appears to only impact release Firefox versions not development Firefox versions (presumably due to a different default/fall-back value).
Hi Leaf,
I recently had reports of my Godot 4 game web/html export (which uses SharedArrayBuffer–and has the experimental SharedArrayBuffer itch.io option enabled) failing to run in Firefox–which was somewhat surprising because Firefox was the only browser I’d tested it with. :)
While investigating possible causes, I happened to base64 decode the transmitted token & realised the expiry field had a value of 1704063600 which equates to 2023-12-31T23+00:00 (UTC).
Based on my current (limited) understanding of the related preference & checking code I think an expired token only impacts release Firefox versions (and I only developed/tested with an (older) development version).
The original bug report on my game:
More details from my investigation than you or almost anyone else is likely to ever want can be found in my follow-up comment: :D
Apologies for not being able to 100% confirm the exact mechanism by which the failure occurs at this time but I wanted to alert you to the potential issue before I lost my “flow” momentum or disappeared down a different rabbit hole. :/ (Especially, as I’m aware that configuration of the whole SharedArrayBuffer feature in browsers these days is quite opaque & there’s many intersecting pieces that need to fit together for it to work correctly.)
Also, apologies in advance if I fail to get back to you on this topic, I will try to do so though, so let me know if any further details are helpful.
Thanks for all your work on itch.io, I really appreciate it. :)
Edit: Added specific mention that this relates to the Origin Trial for the CoepCredentialless feature for clarity and search juice.
This appears to be a related bug on the Godot issue tracker:
“SharedArrayBuffer does not work with Firefox on Android anymore #86988”: https://github.com/godotengine/godot/issues/86988
“A few days ago [issue created 9 Jan 2024] my Godot game stopped working on Itch.IO when opened from a Firefox Android app. […]”
From other comments on the issue it seems like it might be Release and Beta versions default to an error on expiry.
Turns out there’s also a pre-existing itch.io issue too:
Hi Leafo.
I think the change indirectly may have broke some very specific scenario I am currently experiencing. I will try to describe it.
I am a Firefox user and I am developing a game. (Godot 4, browser build)
Because the game is in its testing stages I have the game currently on Restricted with a required password to be able to access the page. Testers can access the page at any time while the game not being officially released yet.
Due to the pop-up change, users reported that the pop-up gave a 404 page when loading the browser game. When I tested it myself (while being logged into Itch.io) The game was working.
Then I tried running the game on a Firefox private tab (not being logged into itch.io) and I also got the 404 page.
I tried playing the game in Edge (without being logged into Itch.io) and I was able to play the browser game normally.
I am suspecting that the pop-up does not know about the password that is required in order to view the Itch.io page of the Restricted game. And that it gives a 404 page instead.
So testers that use Firefox are unable to play the browser build currently.
Thanks for your time!
