search

tauri-apps / tauri

Build smaller, faster, and more secure desktop applications with a web frontend.
https://tauri.app
Apache License 2.0
81.83k stars 2.45k forks source link

[feat] App secured local host #10677

Open GheorgheP opened 3 weeks ago

GheorgheP commented 3 weeks ago

Describe the problem

At the moment the tauri app runs on unsecured host https://tauri.localhost without possibilities to enable SSL, as mentioned here: https://github.com/tauri-apps/tauri/issues/9308#issuecomment-2028466487

Describe the solution you'd like

It would be grate to be able to enable SSL and run the app on https//tauri.localhost

Alternatives considered

No response

Additional context

Most of the services currently requires you to use secured pages. While there may be some alternatives to solve that, like proxying it is always a huge pain to use such alternatives in order to obtain a thing that usually is there by default.

FabianLars commented 3 weeks ago

I do agree that we should make it configurable again, but do you have an example of what's not working for your on http? Since it's localhost it should generally be considered a secure origin (at least for web apis)

GheorgheP commented 3 weeks ago

Ok, my case is pretty specific. I need to register my URL from where i will make requests for some service and the service requires the URL to be secured. The request from the fact that the service will use getUserMedia browser service that requires to be accessed form a secured URL or localhost. I think you could see that the URL needs to be secured or localhost and the app view opens on localhost too. I don't know what's the correct representation of a localhost and is the http://tauri.locahost a correct signature of a localhost URL. So maybe the service is not correct and they should allow it too.

Anyway, we ha other problems like oauth where the provider doesn't allow unsecured redirect URLs and we have to use middleware handlers. Also I suppose that some service where security maybe on first plan (e.g. Stripe, PayPal) may interdict using unsecured resources, even localhost.