ndmitchell / hoogle

Haskell API search engine
http://hoogle.haskell.org/
Other
755 stars 137 forks source link

Bad TLS behavior without -n #432

Open ProducerMatt opened 3 months ago

ProducerMatt commented 3 months ago

I was using 5.0.18.4 with no --https, certificate or key specified. I found that trying to load the page (locally or remote) would hang indefinitely on a TLS handshake.

If I kill the server, my browser starts showing what it had successfully received, which was only the content of the / page with no assets loaded. The command line log confirms that only the / page was requested.

I was stuck on this until I remembered that "CSP" seen in the help page had something to do with TLS, so I tried passing -n. This let me load everything as intended.

I suppose Hoogle without -n tries to serve non-root pages over HTTPS, even if HTTPS mode isn't enabled.

Reproducing:

I am a total noob to Haskell so PEBKAC is always possible. :)