search

aspnet / Tooling

Issue tracker and info on Visual Studio tooling for ASP.NET
Other
256 stars 124 forks source link

BrowserLink Should Use HTTPS #937

Open RehanSaeed opened 7 years ago

RehanSaeed commented 7 years ago

When debugging your site using HTTPS with IIS Express or dotnet run, Browser Link injects scripts from the HTTP scheme. This breaks pages, because you get mixed content security warnings. Ideally Browser Link should be using HTTPS as the default. Additionally, if using Content Security Policy (CSP) with the upgrade-insecure-requests directive, then the BrowserLink URL's are switched to HTTPS which fails.

Also, it would be nice if BrowserLink could tell you which port it's using or if this could be configured, so that those ports can be added to any Content Security Policy (CSP).

Related Issue https://github.com/aspnet/Tooling/issues/490 already shows that Browser Link does not work with HTTPS at all.

damienbod commented 7 years ago

Is thie related: https://github.com/aspnet/Tooling/issues/830

jodavis commented 7 years ago

@RehanSaeed This should be working in VS 2017 RC with the latest Microsoft.VisualStudio.Web.BrowserLink package (1.0.1 or 1.1.0). Browser Link should add an HTTPS link when the request is made against an HTTPS URL. Are you still seeing the issue with these releases?

Whathecode commented 7 years ago

@jodavis Yes, using Microsoft.VisualStudio.Web.BrowserLink works. However, I ended up here because I was using a ASP.NET Core Web Application template which seemingly imported Microsoft.VisualStudio.Web.BrowserLink.Loader (14.1.0) instead. Uninstalling the latter and installing the former resolved the issue for me.

natelaff commented 7 years ago

I still can't get BrowserLink to work with HTTPS. It just doesn't show up at all even in VS 2017. Or is that still not fixed yet per https://github.com/aspnet/Tooling/issues/490