Interactivity: Fix crypto.randomUUID crash in non-secure contexts#76151
Merged
luisherranz merged 5 commits intotrunkfrom Mar 5, 2026
Merged
Interactivity: Fix crypto.randomUUID crash in non-secure contexts#76151luisherranz merged 5 commits intotrunkfrom
luisherranz merged 5 commits intotrunkfrom
Conversation
crypto.randomUUID() is only available in secure contexts (HTTPS or localhost). Sites served over plain HTTP (e.g. http://wp-src.test) crash the entire interactivity module at import time. Add a feature-detection guard that falls back to a Math.random-based identifier when crypto.randomUUID is unavailable. The sessionId only needs to be unique per page load, not cryptographically secure. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message. To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
|
Size Change: +3 B (0%) Total Size: 6.87 MB
ℹ️ View Unchanged
|
aduth
approved these changes
Mar 4, 2026
Member
aduth
left a comment
aduth
left a comment
There was a problem hiding this comment.
I'm not intimately familiar with this feature, though judging by its current usage I expect that any relatively-unique string should suffice. It might be a good thing to have test coverage for, both the expected shape ("any string", "not the same between two calls") as well as in an environment with/without crypto.randomUUID available.
crypto.getRandomValues is available in all contexts (not just secure contexts like randomUUID), providing a better fallback than Math.random. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
luisherranz
added
the
Backport to WP 7.0 Beta/RC
Member
|
I'm going to simplify it a bit because actually, there's no need to use a very complex random id. No changes are needed in the tests since they correctly test the behavior. |
Also fixes previous entry
|
Flaky tests detected in ef5b124. 🔍 Workflow run URL: https://github.com/WordPress/gutenberg/actions/runs/22711677186
|
Contributor
Author
|
Thanks! |
github-actions
bot
removed
the
Backport to WP 7.0 Beta/RC
gutenbergplugin
pushed a commit
that referenced
this pull request
Mar 5, 2026
…6151) * Interactivity: Fix crypto.randomUUID crash in non-secure contexts crypto.randomUUID() is only available in secure contexts (HTTPS or localhost). Sites served over plain HTTP (e.g. http://wp-src.test) crash the entire interactivity module at import time. Add a feature-detection guard that falls back to a Math.random-based identifier when crypto.randomUUID is unavailable. The sessionId only needs to be unique per page load, not cryptographically secure. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Interactivity: Use crypto.getRandomValues for sessionId fallback crypto.getRandomValues is available in all contexts (not just secure contexts like randomUUID), providing a better fallback than Math.random. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Simplify sessionId * Add changelog Also fixes previous entry --------- Co-authored-by: scruffian <scruffian@git.wordpress.org> Co-authored-by: aduth <aduth@git.wordpress.org> Co-authored-by: luisherranz <luisherranz@git.wordpress.org>
github-actions
bot
added
the
Backported to WP Core
|
I just cherry-picked this PR to the wp/7.0 branch to get it included in the next release: e499abf |
pento
pushed a commit
to WordPress/wordpress-develop
that referenced
this pull request
Mar 5, 2026
CI run: #11167. See #64595. --- I've included a log of the Gutenberg changes with the following command: git log --reverse --format="- %s" 022d8dd3d461f91b15c1f0410649d3ebb027207f..e499abfb843a43ac88455ca319220c5f181e1cf3 | sed 's|#\([0-9][0-9]*\)|https://github.com/WordPress/gutenberg/pull/\1|g; /github\.com\/WordPress\/gutenberg\/pull/!d' | pbcopy - Add documentation for contentRole and listView block supports (WordPress/gutenberg#75903) - Interactivity Router: fix back and forward navigation after refresh (WordPress/gutenberg#75927) - Real-time collaboration: Fix disconnect dialog on navigate (WordPress/gutenberg#75886) - Real Time Collab: Throttle syncing for inactive tabs. (WordPress/gutenberg#75843) - Components: Specify line-height to avoid inheriting default values (WordPress/gutenberg#75880) - Pattern Editing: Fix sibling blocks to edited pattern not being disabled (WordPress/gutenberg#75994) - Sync connector PHP behavior with Core backport changes (WordPress/gutenberg#75968) - Connectors: Avoid manual string concatenation (WordPress/gutenberg#75997) - DataForm: fix field label for panel (should not be uppercase) (WordPress/gutenberg#75944) - Views: add support for more overrides (all developer-defined config) (WordPress/gutenberg#75971) - Use homeUrl instead of siteUrl for link badge evaluations (WordPress/gutenberg#75978) - DataViews: Right-align `integer` and `number` fields (WordPress/gutenberg#75917) - Navigation Link: Compare internal links by host instead of origin (WordPress/gutenberg#76015) - Fix: Skip scaled image sideload for images below big image threshold (WordPress/gutenberg#75990) - Client side media cherry pick for 7.0 (WordPress/gutenberg#75998) - Show transform dropdown previews on focus as well as hover (WordPress/gutenberg#75940) (WordPress/gutenberg#75992) - RTC: Fix syncing of emoji / surrogate pairs (WordPress/gutenberg#76049) - [Real-time Collaboration] Fix sync issue on refresh (WordPress/gutenberg#76017) - Real-time collaboration: Improve disconnect dialog (WordPress/gutenberg#75970) - DataViews: Fix filter toggle flickering when there are locked or primary filters (WordPress/gutenberg#75913) (WordPress/gutenberg#76068) - Connectors: Dynamically register providers from WP AI Client registry (WordPress/gutenberg#76014) - PHP-only Blocks: Reflect bound attribute values in inspector controls (WordPress/gutenberg#76040) - Fix: Set quality and strip metadata in client-side image resize (WordPress/gutenberg#76029) - RTC: Prevent duplicate poll cycles (WordPress/gutenberg#76059) - RTC: Fix stale CRDT document persisted on save (WordPress/gutenberg#75975) - RTC: Disable multiple collaborators if meta boxes are present (WordPress/gutenberg#75939) - Directly inject styles in overlay to make styles stay consistently mounted (WordPress/gutenberg#75700) - Real-time collaboration: Fix comment syncing on site editor (WordPress/gutenberg#75746) - Real-time Collaboration: Bug fix for CRDT user selection and add tests (WordPress/gutenberg#75075) - RTC: Updates from backport PR (WordPress/gutenberg#75711) - RTC: Fix undefined array_first() call in sync storage (WordPress/gutenberg#75869) - RTC: Fix fallthrough for sync update switch statement (WordPress/gutenberg#76060) - Real-time collaboration: Remove block client IDs from Awareness, fix "Show Template" view (WordPress/gutenberg#75590) - RTC: Add session activity notifications (WordPress/gutenberg#76065) - Prevent non-reproducible Sass/CSS builds. (WordPress/gutenberg#76098) - Block toolbar and context menu: hide pattern actions in Revisions UI (WordPress/gutenberg#76066) - Try enabling style variation transforms for blocks in contentOnly mode (WordPress/gutenberg#75761) - Block toolbar: hide styles dropdown in Revisions UI (WordPress/gutenberg#76119) - Image block: fix lightbox srcset size (WordPress/gutenberg#76092) - Fix writing flow navigation for annotation style, or any other block with border radius (WordPress/gutenberg#76072) - Image: Hide 'Set as featured image' for in-editor revisions (WordPress/gutenberg#76123) - Connectors: Gate unavailable install actions behind install capability (WordPress/gutenberg#75980) - build: Exclude experimental pages from Core builds (WordPress/gutenberg#76038) - HTML & Shortcode: Disable viewport visibility support (WordPress/gutenberg#76138) - RTC: Verify client ID to avoid awareness mutation (WordPress/gutenberg#76056) - wp-build: Do not remove Core's default script modules registration (WordPress/gutenberg#75705) - wp-build: Deregister script modules before re-registering (WordPress/gutenberg#75909) - Remove `! function_exists()` checks from PHP templates (WordPress/gutenberg#76062) - Connectors: Update page identifier to options-connectors (WordPress/gutenberg#76156) - Connectors: Align init hook priorities with Core overrides (WordPress/gutenberg#76161) - Icon Block: Clean up selectors config (WordPress/gutenberg#75786) - Icons: Fix incorrect icon slug (WordPress/gutenberg#76165) - RTC: Enable RTC by default (WordPress/gutenberg#75739) - Rename and visibility modals: gate shortcuts behind canEditBlock to prevent triggering in revisions UI (WordPress/gutenberg#76168) - Fix: Block style variations not rendering in Site Editor Patterns page (WordPress/gutenberg#76122) - Client-side media processing: only use media upload provider when not in preview mode (WordPress/gutenberg#76124) - Notes: Disable for in-editor revisions (WordPress/gutenberg#76180) - Core Data: Support reading revision data in useEntityProp (fixes footnotes in revisions UI) (WordPress/gutenberg#76106) - Client-side media processing: Try plumbing invalidation to the block-editor's mediaUpload onSuccess callback (WordPress/gutenberg#76173) - Connectors: Improve responsive layout on small screens (WordPress/gutenberg#76186) - Interactivity API: Fix router initialization race condition on Safari/Firefox (WordPress/gutenberg#76053) (WordPress/gutenberg#76191) - Interactivity: Fix crypto.randomUUID crash in non-secure contexts (WordPress/gutenberg#76151) git-svn-id: https://develop.svn.wordpress.org/trunk@61843 602fd350-edb4-49c9-b593-d223f7449a82
markjaquith
pushed a commit
to markjaquith/WordPress
that referenced
this pull request
Mar 5, 2026
CI run: WordPress/wordpress-develop#11167. See #64595. --- I've included a log of the Gutenberg changes with the following command: git log --reverse --format="- %s" 022d8dd3d461f91b15c1f0410649d3ebb027207f..e499abfb843a43ac88455ca319220c5f181e1cf3 | sed 's|#\([0-9][0-9]*\)|https://github.com/WordPress/gutenberg/pull/\1|g; /github\.com\/WordPress\/gutenberg\/pull/!d' | pbcopy - Add documentation for contentRole and listView block supports (WordPress/gutenberg#75903) - Interactivity Router: fix back and forward navigation after refresh (WordPress/gutenberg#75927) - Real-time collaboration: Fix disconnect dialog on navigate (WordPress/gutenberg#75886) - Real Time Collab: Throttle syncing for inactive tabs. (WordPress/gutenberg#75843) - Components: Specify line-height to avoid inheriting default values (WordPress/gutenberg#75880) - Pattern Editing: Fix sibling blocks to edited pattern not being disabled (WordPress/gutenberg#75994) - Sync connector PHP behavior with Core backport changes (WordPress/gutenberg#75968) - Connectors: Avoid manual string concatenation (WordPress/gutenberg#75997) - DataForm: fix field label for panel (should not be uppercase) (WordPress/gutenberg#75944) - Views: add support for more overrides (all developer-defined config) (WordPress/gutenberg#75971) - Use homeUrl instead of siteUrl for link badge evaluations (WordPress/gutenberg#75978) - DataViews: Right-align `integer` and `number` fields (WordPress/gutenberg#75917) - Navigation Link: Compare internal links by host instead of origin (WordPress/gutenberg#76015) - Fix: Skip scaled image sideload for images below big image threshold (WordPress/gutenberg#75990) - Client side media cherry pick for 7.0 (WordPress/gutenberg#75998) - Show transform dropdown previews on focus as well as hover (WordPress/gutenberg#75940) (WordPress/gutenberg#75992) - RTC: Fix syncing of emoji / surrogate pairs (WordPress/gutenberg#76049) - [Real-time Collaboration] Fix sync issue on refresh (WordPress/gutenberg#76017) - Real-time collaboration: Improve disconnect dialog (WordPress/gutenberg#75970) - DataViews: Fix filter toggle flickering when there are locked or primary filters (WordPress/gutenberg#75913) (WordPress/gutenberg#76068) - Connectors: Dynamically register providers from WP AI Client registry (WordPress/gutenberg#76014) - PHP-only Blocks: Reflect bound attribute values in inspector controls (WordPress/gutenberg#76040) - Fix: Set quality and strip metadata in client-side image resize (WordPress/gutenberg#76029) - RTC: Prevent duplicate poll cycles (WordPress/gutenberg#76059) - RTC: Fix stale CRDT document persisted on save (WordPress/gutenberg#75975) - RTC: Disable multiple collaborators if meta boxes are present (WordPress/gutenberg#75939) - Directly inject styles in overlay to make styles stay consistently mounted (WordPress/gutenberg#75700) - Real-time collaboration: Fix comment syncing on site editor (WordPress/gutenberg#75746) - Real-time Collaboration: Bug fix for CRDT user selection and add tests (WordPress/gutenberg#75075) - RTC: Updates from backport PR (WordPress/gutenberg#75711) - RTC: Fix undefined array_first() call in sync storage (WordPress/gutenberg#75869) - RTC: Fix fallthrough for sync update switch statement (WordPress/gutenberg#76060) - Real-time collaboration: Remove block client IDs from Awareness, fix "Show Template" view (WordPress/gutenberg#75590) - RTC: Add session activity notifications (WordPress/gutenberg#76065) - Prevent non-reproducible Sass/CSS builds. (WordPress/gutenberg#76098) - Block toolbar and context menu: hide pattern actions in Revisions UI (WordPress/gutenberg#76066) - Try enabling style variation transforms for blocks in contentOnly mode (WordPress/gutenberg#75761) - Block toolbar: hide styles dropdown in Revisions UI (WordPress/gutenberg#76119) - Image block: fix lightbox srcset size (WordPress/gutenberg#76092) - Fix writing flow navigation for annotation style, or any other block with border radius (WordPress/gutenberg#76072) - Image: Hide 'Set as featured image' for in-editor revisions (WordPress/gutenberg#76123) - Connectors: Gate unavailable install actions behind install capability (WordPress/gutenberg#75980) - build: Exclude experimental pages from Core builds (WordPress/gutenberg#76038) - HTML & Shortcode: Disable viewport visibility support (WordPress/gutenberg#76138) - RTC: Verify client ID to avoid awareness mutation (WordPress/gutenberg#76056) - wp-build: Do not remove Core's default script modules registration (WordPress/gutenberg#75705) - wp-build: Deregister script modules before re-registering (WordPress/gutenberg#75909) - Remove `! function_exists()` checks from PHP templates (WordPress/gutenberg#76062) - Connectors: Update page identifier to options-connectors (WordPress/gutenberg#76156) - Connectors: Align init hook priorities with Core overrides (WordPress/gutenberg#76161) - Icon Block: Clean up selectors config (WordPress/gutenberg#75786) - Icons: Fix incorrect icon slug (WordPress/gutenberg#76165) - RTC: Enable RTC by default (WordPress/gutenberg#75739) - Rename and visibility modals: gate shortcuts behind canEditBlock to prevent triggering in revisions UI (WordPress/gutenberg#76168) - Fix: Block style variations not rendering in Site Editor Patterns page (WordPress/gutenberg#76122) - Client-side media processing: only use media upload provider when not in preview mode (WordPress/gutenberg#76124) - Notes: Disable for in-editor revisions (WordPress/gutenberg#76180) - Core Data: Support reading revision data in useEntityProp (fixes footnotes in revisions UI) (WordPress/gutenberg#76106) - Client-side media processing: Try plumbing invalidation to the block-editor's mediaUpload onSuccess callback (WordPress/gutenberg#76173) - Connectors: Improve responsive layout on small screens (WordPress/gutenberg#76186) - Interactivity API: Fix router initialization race condition on Safari/Firefox (WordPress/gutenberg#76053) (WordPress/gutenberg#76191) - Interactivity: Fix crypto.randomUUID crash in non-secure contexts (WordPress/gutenberg#76151) Built from https://develop.svn.wordpress.org/trunk@61843 git-svn-id: http://core.svn.wordpress.org/trunk@61130 1a063a9b-81f0-0310-95a4-ce76da25c4cd
luisherranz
added
the
Backport to Gutenberg RC
scruffian
added a commit
that referenced
this pull request
Mar 6, 2026
…6151) * Interactivity: Fix crypto.randomUUID crash in non-secure contexts crypto.randomUUID() is only available in secure contexts (HTTPS or localhost). Sites served over plain HTTP (e.g. http://wp-src.test) crash the entire interactivity module at import time. Add a feature-detection guard that falls back to a Math.random-based identifier when crypto.randomUUID is unavailable. The sessionId only needs to be unique per page load, not cryptographically secure. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Interactivity: Use crypto.getRandomValues for sessionId fallback crypto.getRandomValues is available in all contexts (not just secure contexts like randomUUID), providing a better fallback than Math.random. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Simplify sessionId * Add changelog Also fixes previous entry --------- Co-authored-by: scruffian <scruffian@git.wordpress.org> Co-authored-by: aduth <aduth@git.wordpress.org> Co-authored-by: luisherranz <luisherranz@git.wordpress.org>
Contributor
Author
|
I just cherry-picked this PR to the release/22.7 branch to get it included in the next release: 54b53f8 |
scruffian
removed
the
Backport to Gutenberg RC
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
crypto.randomUUID()is only available in secure contexts (HTTPS or localhost). Commit 1fabaf6 (PR #75927) addedexport const sessionId = crypto.randomUUID()at the top level ofpackages/interactivity/src/utils.ts, which crashes the entire interactivity module on sites served over plain HTTP (e.g.http://wp-src.test).This PR simplifies the
sessionIdto useMath.random(), which works in all contexts. ThesessionIdonly needs to be unique per page load, not cryptographically secure.Test plan
http://wp-src.test)crypto.randomUUIDas before)🤖 Generated with Claude Code