search

GitbookIO / nuts

:chestnut: Releases/downloads server with auto-updater and GitHub as a backend
http://nuts.gitbook.com
Apache License 2.0
1.25k stars 300 forks source link

Forcing HTTPS responses? Attempts to fix ATS errors #169

Closed raphaelschaad closed 4 years ago

raphaelschaad commented 4 years ago

Is forcing HTTPS responses a good idea? https://medium.com/@connorlurring/fixing-nuts-auto-updates-for-our-electron-app-64beeed8b14 /by @connorlurring

The author attempts to fix Apple Transport Security (ATS) errors when the an Electron client requests the update through HTTPS but then the nuts deployment setup (Heroku in this case) returns an HTTP URL. /cc @SamyPesse @AaronO

ogtfaber commented 4 years ago

You can solve this by setting TRUST_PROXY to true in Heroku

See https://github.com/GitbookIO/nuts/issues/163#issuecomment-468916045

connorlurring commented 4 years ago

Hi @raphaelschaad thanks for taking the time to critically evaluate my article!

While forcing HTTPS isn't the optimal solution, it has worked for my use case since that article was written, with no unforeseen issues.

That said, thanks @ogtfaber for bringing #163 to my attention. TRUST_PROXY sounds like a valid solution, I plan to amend the article shortly to recommend it. I wasn't aware that there was a commonplace solution for trusting the proxy in a situation like this, and the original solution was based on the Heroku documentation not having any reference to this config var.

It seems that TRUST_PROXY is a commonly used configuration for a variety of products, and should be more generally suitable as advice, leaving the original functionality of the library unchanged.

raphaelschaad commented 4 years ago

Thanks @ogtfaber for the solution, I have since adopted it. And thanks @connorlurring for updating your post for everyone else, given you're the top result I found googling the problem. You can point to the relevant bits of Nuts' docs. Closing this issue.