A web-based RDP client built with Go WebAssembly and grdp
72 points
7 hours ago
| 4 comments
| github.com
| HN
the_data_nerd
2 hours ago
[-]
clipboard is the boring nightmare of browser-RDP. the wire protocol negotiates fine. the browser side has the clipboard API gated behind permissions plus a user-gesture requirement for writes. on the read side most browsers prompt the user every single time. so you either rebuild a custom in-page clipboard buffer (loses OS integration, defeats the point) or accept that paste-INTO-RDP works smoothly while paste-OUT-of-RDP needs a click each time. neither matches what people expect when they hear "web RDP client." worth checking the project's behavior on chrome vs firefox before assuming feature-parity with native mstsc.
reply
maxloh
1 hour ago
[-]
> ...on the read side most browsers prompt the user every single time.

I don't think that is the case. Google Docs, Office 365, and Notion all function without requiring repeated user permissions.

reply
jerrythegerbil
58 minutes ago
[-]
I can assure you they’ve correctly described the problem and are correct regarding buffering and user gesture requirements.

The platforms you listed are all primarily text-based and the interaction lives in the DOM with happy paths defined. Still, you will find that clipboard media with a MIME type will prompt you with a Google provided modal to paste a very specific way to get around the permissions model in Google Docs etc…

An RDP interface is not a text box with features on top, the standing expectations for those existing behaviors do not apply. Namely clipboard, and any I/O for that matter. For example, the linked repo uses a protocol bridge (I/O) to support the RDP protocol from a browser, because “the browser speaks protocols” is a true general statement, but absolutely doesn’t apply when you actually need to get something non-trivial done.

At its core, when someone points to the Google Chrome desktop icon and says “that’s the internet” there’s really no point in discussing the nuance in most cases, because anything non-trivial immediately invalidates that understanding of the world and reaching that point organically is far more important than it being explained to them preemptively.

They are correct, because the nuance applies. Welcome to the un-happy path!

reply
hawk_
58 minutes ago
[-]
There's something about keyboard shortcuts - they work. But somehow right-click and copy requires add-ons.
reply
solarkraft
5 hours ago
[-]
Looks very interesting, but i’m a bit surprised the most important feature isn’t mentioned: How well does clipboard sharing work?
reply
wcrossbow
5 hours ago
[-]
Im not a big fan of Windows but copy pasting a file across 3 nested RDP sessions feels magical every time
reply
hypercube33
1 hour ago
[-]
It actually doesn't it feels horrible. you can't paste files from a samba share or large ones take so long to copy that they ultimately fail.
reply
ktpsns
4 hours ago
[-]
To be honest, three nested RDPs sound like a terrible hack. In an ideal world, this would be two port forwardings and one RDP (thinking about ssh, which is still underrepresented in windows world). In an even more ideal world, this would be an IPv6 direct access ;-)
reply
everforward
3 hours ago
[-]
There are legit reasons, at least for two nested sessions. A production network that’s airgapped except for a bastion host that acts as a gateway. It’s better than port forwarding because you have to auth to the bastion host before the RDP chaining, and it often takes separate credentials for the second RDP session.

It’s a semi-common setup for higher security environments, and when you have a network of stuff that has known vulnerabilities you can’t patch for whatever reason. Traffic in and out is super carefully firewalled. It’s not great, but it’s better than a 25 year old MySQL with a direct public IP.

reply
embedding-shape
3 hours ago
[-]
> airgapped except for a bastion host that acts as a gateway

First time I've heard of an airgapped system you could access remotely. Doesn't that kind of defeat the label "airgapped"? I think I'd just call that "isolated" at that point instead.

reply
debarshri
2 hours ago
[-]
This concept is related to PAM. You often have to do ops on infra and need some DMZ to do the ops. In regulated industry you have to record every operations done by the person and have to follow principle of least privilege. This what should happen in an ideal world.
reply
embedding-shape
2 hours ago
[-]
> You often have to do ops on infra and need some DMZ to do the ops.

This makes sense, "bastion" hosts and similar things is fairly common too. What's not common is calling those "airgapped", because they're clearly not.

reply
hnlmorg
1 hour ago
[-]
I agree. They’re network enclaves. Which isn’t the same thing as an air gapped network.
reply
debarshri
2 hours ago
[-]
Airgapped is a different concept altogether.
reply
SigmundA
2 hours ago
[-]
reply
rzzzt
3 hours ago
[-]
The moat!
reply
orisho
3 hours ago
[-]
It's probably there not as a way to connect networks, but as a way to keep them separate, only allowing RDP between specific computers on different networks.
reply
debarshri
2 hours ago
[-]
I am not sure if you have tried broadcasting feature in terminals, thats magical too.
reply
debarshri
2 hours ago
[-]
We have a custom RDP client [1]. So i have some experience building something like this. We do some an implementation similar to this.

Clipboard sharing, uploading and downloading via shared drive is a freerdp feature that should be readily available.

We also have sessions recording which is non-negotiable in PAM.

[1] https://adaptive.live

reply
d3Xt3r
5 hours ago
[-]
And desktop scaling. And multi-monitor support. And file transfers. And drive redirection. And peripheral redirection. And...
reply
rvz
4 hours ago
[-]
...A test suite, And security audits, And most importantly benchmarks.

What it does have is a license which it is GPLv3. So if anyone adds all those changes, they have to make the source code available with the same software license.

reply
pixel_popping
3 hours ago
[-]
In this era tho, licenses (I don't agree with this, but this is what it is) are a matter of "tokens", I speak for a fact knowing multiple relatively-big companies just gobbling GPLv3 projects and rewriting them entirely, some do publish them as well.
reply
yamapikarya
2 hours ago
[-]
is it work for opening rdp file from cyberark pam?
reply
jqpabc123
6 hours ago
[-]
Interesting from a technical perspective but with native RDP clients readily available on just about every platform, I don't see the need for it.
reply
le-mark
4 hours ago
[-]
When it’s in a browser you don’t need to install anything on the local machine. I used to use Apache guacamole to access my machine at home from work when I was stuck in a cube all day.

https://guacamole.apache.org/

reply
stephbook
2 hours ago
[-]
1 contributor, 1 commit, new project... gives me vibe-coding feels.
reply
tom_alexander
1 hour ago
[-]
Perhaps as a web client for the remote desktop on the BMC chips?
reply
pixel_popping
3 hours ago
[-]
Browsers are sandboxes, your native client often isn't, there is definitely a huge advantage, portability and embeddability as well, it's also simpler to sniff traffic (and MITM it).
reply
jqpabc123
1 hour ago
[-]
Doesn't this limit your ability to share resources and transfer data?
reply
boredishBoi
5 hours ago
[-]
Not many good MFA options for native RDP/RDG. Putting it in the browser lets you wrap the whole thing with OAUTH/passkeys etc
reply
hnlmorg
1 hour ago
[-]
Having just implemented OAUTH into a Go app this week, I can assure you that it’s surprising easy to do so without making your entire application a website.
reply