News for hackers. Stuff that matters.

A comment on Life Is About to Get Harder for Websites Without HTTPS. Parent comment

Re:Life Is About to Get Harder for Websites Without HTTPS by cryo on Wednesday July 12, 2017 @08:17AM (#14751838)
>These big warning windows are for connecting to it from a browser, not a RestClient.

Which in my case is a webapp running in a browser :)

[ Parent | on HN ]
Re:Life Is About to Get Harder for Websites Without HTTPS by akvadrako on Wednesday July 12, 2017 @08:55AM (#14752068)
So any random webpage can talk to your Hue bridge?

I'm surprised they even allow such cross-domain requests, but this anyway doesn't seem safe.

[ Parent | on HN ]
Re:Life Is About to Get Harder for Websites Without HTTPS by cryo on Wednesday July 12, 2017 @01:49PM (#14754738)
Cross-domain is needed, otherwise an app/webapp couldn't talk to the bridge since the bridge only serves the REST API.

However in order to send control commands and query light states the app/webapp needs to authenticate and create a account, which is only possible for a few seconds after pressing a physical bridge button.

[ Parent | on HN ]
Re:Life Is About to Get Harder for Websites Without HTTPS by Jaruzel on Wednesday July 12, 2017 @08:38AM (#14751951)
Why not just proxy the REST requests through your own backend HTTPS server-app ?
[ Parent | on HN ]