Re:Life Is About to Get Harder for Websites Without HTTPS
by cm2187 on Wednesday July 12, 2017 @06:05AM
(#14751311)
If it is an http API, you don't really need a public certificate. You can have a long term selfsigned certificate on the device and you check that the thumbprint hasn't changed every time you connect from your client. These big warning windows are for connecting to it from a browser, not a RestClient.
[ Parent
| on HN ]
Re:Life Is About to Get Harder for Websites Without HTTPS
by cryo on Wednesday July 12, 2017 @08:17AM
(#14751838)
>These big warning windows are for connecting to it from a browser, not a RestClient.
Which in my case is a webapp running in a browser :)
Re:Life Is About to Get Harder for Websites Without HTTPS
by akvadrako on Wednesday July 12, 2017 @08:55AM
(#14752068)
So any random webpage can talk to your Hue bridge?
I'm surprised they even allow such cross-domain requests, but this anyway doesn't seem safe.
Re:Life Is About to Get Harder for Websites Without HTTPS
by cryo on Wednesday July 12, 2017 @01:49PM
(#14754738)
Cross-domain is needed, otherwise an app/webapp couldn't talk to the bridge since the bridge only serves the REST API.
However in order to send control commands and query light states the app/webapp needs to authenticate and create a account, which is only possible for a few seconds after pressing a physical bridge button.