Devlog: building the browser interface

---

Every other app in AuriaOS gave me something real and had bugs that behaved normally. The browser gave me two completely different problems, each one hiding behind the last.

Problem one: search engines don’t want to be embedded

With the real browser wired up, the address bar, back/forward/reload/home and an actual iframe, it looked done. Typing a URL worked but typing a search term did not. Every search just sat there, blank. I got to know why that was very soon from the console:

textFraming 'https://html.duckduckgo.com/' violates the following ContentSecurity Policy directive: "frame-ancestors 'self'". The request hasbeen blocked.

DuckDuckGo sends a header that basically says “don’t let anyone put me inside another page” but that’s not just a DuckDuckGo thing though, it’s standard for basically every search engine because a framed search results page is a classic clickjacking setup. No amount of JavaScript on my end changes an HTTP header the other server is sending. Well, this can’t be considered a bug, it was like a wall and every search engine has the same one. So the fix wasn’t really a fix, it was about rethinking the whole situation. I had to stop trying to show search results inside the embedded view and just open them in a real new tab instead where framing rules don’t apply. Direct URLs still load inside the app like before since plenty of ordinary sites don’t block framing, it’s the search engines specifically.

Problem two: it worked but it didn’t feel like it worked

Search now actually functioned since New tab pops open with real results every time. And the very next thing I thought of was “it acts like a separate window opener instead of being part of the browser app” and it was a fair thought. What I really wanted was to show search results inside the iframe which loops straight back to problem one. I didn’t have much choice. I pushed back on that hard. Everything else in AuriaOS does what it claims to do. The terminal runs real commands, the calculator does real math and I didn’t want the browser to be the one app quietly faking it. But I eventually decided to keep the new tab. Added a small toast inside the browser window itself. “Opened search in a new tab” that fades in for about two seconds and back out. Doesn’t change where the search happens it just closes the feedback gap. Something visibly happens inside the app the moment you hit Go instead of the window just sitting there while a tab opens somewhere else on screen