Running QuickJS WebAssembly in a Secure Iframe Enclave
Background and Setup Context
Embedding QuickJS (a lightweight JavaScript engine) compiled to WebAssembly inside an isolated iframe (“soft enclave”) is a strategy to run untrusted JS code safely. In this setup, a parent page (e.g. on http://localhost:3000) hosts an pointing to an enclave page on another origin (e.g. http://localhost:3010). The enclave page loads the QuickJS WebAssembly module (via Emscripten) and executes guest code, while the parent and iframe are isolated from each other’s data (different origin prevents cookie/localStorage access ). To maximize security, we enforce a strict Content Security Policy (CSP) and use Cross-Origin Opener/Embedder Policies (COOP/COEP) so the iframe runs in a locked-down, cross-origin isolated context. However, misconfigurations in headers or CSP can cause the WebAssembly to fail loading with errors like “CompileError: WebAssembly.instantiate()”. Below, we detail the required HTTP headers, CSP settin