Improve the loader policy

Improve the loader policy

WelsonJS.Toolkit/WelsonJS.Launcher/AssemblyLoader.cs

@@ -29,13 +29,16 @@ namespace WelsonJS.Launcher
         /// Must be set before Register() or LoadNativeModules().
         /// </summary>
         public static string BaseUrl { get; set; } = null;
+        public static ICompatibleLogger Logger { get; set; } = null;
 
         private static readonly object SyncRoot = new object();
         private static bool _registered;
 
         private static readonly string LoaderNamespace = typeof(AssemblyLoader).Namespace ?? "WelsonJS.Launcher";
-        private static readonly HttpClient Http = new HttpClient();
-        private static readonly ICompatibleLogger Logger = new TraceLogger();
+        private static readonly HttpClient Http = new HttpClient
+        {
+            Timeout = TimeSpan.FromSeconds(300)  // 5 minutes
+        };
 
         // -------------------- kernel32 native loading --------------------
 
@@ -150,6 +153,12 @@ namespace WelsonJS.Launcher
                 throw new InvalidOperationException("AssemblyLoader.BaseUrl must be configured before Register().");
             }
 
+            if (!BaseUrl.StartsWith("https://", StringComparison.OrdinalIgnoreCase))
+            {
+                Logger.Error("AssemblyLoader.BaseUrl must use HTTPS for security.");
+                throw new InvalidOperationException("AssemblyLoader.BaseUrl must use HTTPS.");
+            }
+
             AppDomain.CurrentDomain.AssemblyResolve += OnAssemblyResolve;
             _registered = true;
 

WelsonJS.Toolkit/WelsonJS.Launcher/Program.cs

@@ -34,6 +34,7 @@ namespace WelsonJS.Launcher
 
             // load external assemblies
             AssemblyLoader.BaseUrl = GetAppConfig("AssemblyBaseUrl");
+            AssemblyLoader.Logger = _logger;
             AssemblyLoader.Register();
             AssemblyLoader.LoadNativeModules("ChakraCore", new Version(1, 13, 0, 0), new[] { "ChakraCore.dll" });