nextcloud / app_api

Nextcloud AppAPI
https://apps.nextcloud.com/apps/app_api
GNU Affero General Public License v3.0
81 stars 7 forks source link

ExApp's NEXTCLOUD_URL should be HTTPS when DeployDaemon use HTTPS #298

Closed bigcat88 closed 4 months ago

bigcat88 commented 5 months ago

Usually, if the daemon is remote and with HTTPS, it means that the network on which it is used is untrusted. In this case, ExApp should (by default) use HTTPS to communicate with Nextcloud.

Ticking on this button:

image

should by default change Nextcloud Url to "HTTPS".

And when NEXTCLOUD_URL is set to HTTP, and DeployDaemon is set to HTTPS, there must be at least a red (or yellow) URL square - so that it immediately attracts attention.


Why this is very important is not worth explaining; in the current implementation of the UI, AppAPI by default offers the admin to “shoot himself in the foot” in the event of a remote installation of ExApp.

P.S: It should still be possible to change this to HTTP by hand (at least for development systems where the certificates are self-signed)