Library requires https on localhost in development - Githubissues

web-eid / web-eid.js

Add secure authentication and digital signing with electronic ID smart cards to web apps with the Web eID JavaScript library

https://web-eid.eu

MIT License

41 stars 19 forks source link

Library requires https on localhost in development #30

Open tenor-dev opened 2 years ago

tenor-dev commented 2 years ago

To make development with the library easier, it should allow http://localhost:XXX or provide an option to disable https check.

taneltm commented 1 year ago

I agree, it would make development and testing easier.

Both the library and the extension check for Secure Context, which makes an exception for locally-delivered resources.

Locally-delivered resources such as those with http://127.0.0.1 URLs, http://localhost and http://*.localhost URLs (e.g. http://dev.whatever.localhost/), and file:// URLs are also considered to have been delivered securely.

However, web-eid-app does not allow http://localhost and exits with ERR_WEBEID_NATIVE_FATAL.

origin scheme has to be https or wss in src/controller/command-handlers/certificatereader.cpp:134:validateAndStoreOrigin

As I see it, we could solve it in two ways:

Change web-eid-app to allows local origins without HTTPS
Make the extension lie about the origin in DEBUG mode and provide https://debug.localhost as the origin to web-eid-app.

As a workaround, you can edit /web-eid-webextension/src/content/content.ts and replace all instances of event.origin with "https://localhost".