News for hackers. Stuff that matters.

A comment on Certificates for localhost. Parent comment

Re:Certificates for localhost by randomfool on Wednesday June 20, 2018 @05:55PM (#17360159)
As discussed in crbug.com/378566, Chrome currently allows connecting to unsafe WebSockets on localhost. So just use a WebSocket to communicate from your HTTPS hosted page to your local server.

And yes, you definitely should whitelist access based on the origin header.

[ Parent | on HN ]
Re:Certificates for localhost by Ajedi32 on Wednesday June 20, 2018 @11:14PM (#17361814)
There's also "CORS and RFC1918"[1], which IMO would be a great way to stop apps from unintentionally exposing themselves to the open web.

[1]: https://wicg.github.io/cors-rfc1918/#headers

[ Parent | on HN ]
Re:Certificates for localhost by chillydawg on Thursday June 21, 2018 @04:53AM (#17363286)
I tried this and Chrome complains about mixed mode and forces you to allow this behaviour and then to reload the page before you can get it working. If that's acceptable, then sure, but for actual use it's not really any good.
[ Parent | on HN ]
Re:Certificates for localhost by randomfool on Thursday June 21, 2018 @01:17PM (#17367158)
Did you connect to ws://localhost:<port>/?

As mentioned in the bug above, this approach is currently recommended by Chrome and in use by a number of large applications/sites.

It's completely transparent and is being used in production today.

[ Parent | on HN ]