Use valid cert for HTTPS in development #3441

Activity

1. radi-cho commented on Nov 11, 2017

   

   radi-cho

   on Nov 11, 2017

   Last edited by radi-cho

   Author

   More actions

   I fixed this in very interesting and tricky way:

   1. First I exported certificate from chrome (view this).
   2. Imported the certificate into Windows (using certmgr.msc).
   3. Allowed chrome://flags/#allow-insecure-localhost flag. - https://goo.gl/VBV6uR

   And it works! Thanks to Samet Karaibryamov
   

   The most interesting is that 1 and 2 can't fix the security error without 3 and 3 can't without 1 and 2.

   👍React with 👍1Reacted by Luke Secomb
2. radi-cho

   changed the title [-]Question: HTTPS - Your connection is not private[/-] [+]Question/Discussion: Your HTTPS connection is not private[/+] on Nov 11, 2017
3. Dubes commented on Nov 14, 2017

   

   Dubes

   on Nov 14, 2017

   Contributor

   More actions

   Out of curiosity: Why is this needed?
   My (random) thoughts:

   • The warning is correct, as the certificate is not signed by a CA.
   • npm run start should be used only for development and for that http should suffice
   • When we deploy to an environment any other user wants to access, we should ensure proper certificates are in place.
4. radi-cho commented on Nov 14, 2017

   

   radi-cho

   on Nov 14, 2017

   Last edited by radi-cho

   Author

   More actions

   @Dubes I know all of these things, but... Google wants it. I requested verification request for using OAuth.

   Dear Developer,
   According to our information the following redirect URIs are not encrypted and secure.
    
   post_message_origins: "http://localhost"
   post_message_origins: "http://localhost:5000"
   
   Please ensure your redirect URIs are encrypted and secure to ensure data theft does not take place.
   It can be done by using an HTTPS protocol (a secure, encrypted connection).
   Please reply back once you have updated all your redirect URIs for us to proceed with the verification process.
   
   Sincerely,
   Google Cloud Platform/API Trust & Safety
   
5. Timer commented on Nov 14, 2017

   

   Timer

   on Nov 14, 2017

   Contributor

   More actions

   I'm not sure this is in scope of our project to fix, but I'm more than happy to accept a pull request and have some discussion about a possible solution for this.

   Google shouldn't care if the cert isn't valid, I notice your error message says http:// and not https://, so maybe that's your problem?

   It's going to be pretty low priority for us since you're the first to run into it (sorry!).
6. radi-cho commented on Nov 14, 2017

   

   radi-cho

   on Nov 14, 2017

   Author

   More actions

   Yeah, you can add label priority: low, but please keep this open for discussion.
   I'll try to learn more and if I can will open PR.
7. Timer

   added

   issue: proposal

   priority: low (needs more information)

   on Nov 14, 2017
8. Timer

   changed the title [-]Question/Discussion: Your HTTPS connection is not private[/-] [+]Use valid cert for HTTPS in development[/+] on Nov 14, 2017
9. gaearon commented on Jan 8, 2018

   

   gaearon

   on Jan 8, 2018

   Contributor

   More actions

   Closing as stale.

   👍React with 👍1Reacted by Radi Cho
10. gaearon

    closed this as completedon Jan 8, 2018
11. orlowang commented on Jun 25, 2018

    

    orlowang

    on Jun 25, 2018

    More actions

    @Dubes you may use free CA like other js-lib do. I develop electron app, it can't open https://localhost:3000 if it has a invalid certificate, and, yes, use http can make it work, but it will be better as is support.
12. lock

    locked and limited conversation to collaborators on Jan 19, 2019