okTurtles / group-income

A decentralized and private (end-to-end encrypted) financial safety net for you and your friends.
https://groupincome.org
GNU Affero General Public License v3.0
330 stars 43 forks source link

Error reporting when signing up on non-secure contexts #1922

Open corrideat opened 4 months ago

corrideat commented 4 months ago

Problem

When signing up on a non-secure context (i.e., without HTTPS on most origins), the Web Crypto and Subtle Crypto APIs are unavailable, which causes errors when uploading encrypted files (such as profile pictures).

This manifests itself in two ways:

  1. When signing up normally, an error is shown to the user, although it's rather technical
  2. When signing up using an invite link, an error is logged, but nothing is shown to the user, and the user is taken back to the sign up page.

Solution

  1. Improve message shown
  2. Instead of swallowing the error, present it to the user
taoeffect commented 4 months ago

Note: during development, you can reproduce this by taking the anyone-can-join signup link and modifying it from localhost to your LAN IP, and then attempting to sign up using the modified the link from another device on your local area network.