6 ms·

This could be a great way to allow Web apps to talk to native apps. At Folding@home our client software uses a Web frontend. This frontend talks to the native

This could be a great way to allow Web apps to talk to native apps. At Folding@home our client software uses a Web frontend. This frontend talks to the native Folding@home app at localhost over a socket. The problem is that browsers are starting to show security warnings for any non-https traffic and it's not possible to securely give the native app a valid SSL certificate. Reading and writing shared files would let the frontend talk to the back end more securely. Allowing the Web app access to a directory, with disk space restrictions, would be ideal.

yjftsjthsd-h 8y ago
Isn't localhost exempt from http/s restrictions?
- 0xCMP 8y ago
  It's a special case, but HTTPS specific features don't always work. In this cause it's an HTTPS website talking to a local HTTP service which causes the cross-site errors.
bmm6o 8y ago
You can't get a certificate for localhost, but you can get one for foldinglocalhost.com and resolve that to 127.0.0.1.
- unilynx 8y ago
  That requires you to also ship the private key to end users, and your certificate will be revoked once the CA discovers it
  - euroclydon 8y ago
    No, you can just install a self-signed unique cert for each machine.
    - aaaaaaaaaab 8y ago
      But then why do you need the DNS/hosts file hack? You can issue a self-signed cert to localhost/127.0.0.1, put it in the user’s trust store and call it a day.
    - SahAssar 8y ago
      Asking users to install a CA or cert is not a good or scalable solution.
      - vertex-four 8y ago
        Since when does a desktop application need to ask the user anything to install a cert programmatically? Enforced desktop sandboxing hasn't really taken off.
- randomfool 8y ago
  Not according to https://bugs.chromium.org/p/chromium/issues/detail?id=378566#c41 https://bugs.chromium.org/p/chromium/issues/detail?id=378566...
  - bmm6o 8y ago
    That bug is stuck on not breaking exactly this kind of behavior. They cite Dropbox in that thread (though I haven't read the followups yet), who has www.dropboxlocalhost.com resolving to 127.0.0.1. It sounds like Spotify does something similar.
- amaccuish 8y ago
  Not on my network, since I ban dns rebinding
euroclydon 8y ago
You can use the Native Messaging API. Password Managers used to use a localhost listener, but it's less safe than Native Messaging. But if you stick with the HTTP listener, as someone else mentioned, while you're installing your app, you can edit the user's host file to add a domain name to the loopback adapter, and then you can also create a one-off SSL cert for the computer.
- jcoffland 8y ago
  Thanks, I did not know about Native Messaging API. Unfortunately it appears to be only supported by Chrome.
  - amaccuish 8y ago
    Hi there. Sorry I'm a bit late, but Firefox definitely supports native messaging with their new WebExtensions architecture; the extension I use with my Estonian ID card uses native message to talk to a native component, which in turn talks to my card.

yjftsjthsd-h 8y ago

Isn't localhost exempt from http/s restrictions?

0xCMP 8y ago
It's a special case, but HTTPS specific features don't always work. In this cause it's an HTTPS website talking to a local HTTP service which causes the cross-site errors.

bmm6o 8y ago

You can't get a certificate for localhost, but you can get one for foldinglocalhost.com and resolve that to 127.0.0.1.

unilynx 8y ago
That requires you to also ship the private key to end users, and your certificate will be revoked once the CA discovers it
- euroclydon 8y ago
  No, you can just install a self-signed unique cert for each machine.
  - aaaaaaaaaab 8y ago
    But then why do you need the DNS/hosts file hack? You can issue a self-signed cert to localhost/127.0.0.1, put it in the user’s trust store and call it a day.
  - SahAssar 8y ago
    Asking users to install a CA or cert is not a good or scalable solution.
    - vertex-four 8y ago
      Since when does a desktop application need to ask the user anything to install a cert programmatically? Enforced desktop sandboxing hasn't really taken off.
randomfool 8y ago
Not according to https://bugs.chromium.org/p/chromium/issues/detail?id=378566#c41 https://bugs.chromium.org/p/chromium/issues/detail?id=378566...
- bmm6o 8y ago
  That bug is stuck on not breaking exactly this kind of behavior. They cite Dropbox in that thread (though I haven't read the followups yet), who has www.dropboxlocalhost.com resolving to 127.0.0.1. It sounds like Spotify does something similar.
amaccuish 8y ago
Not on my network, since I ban dns rebinding

euroclydon 8y ago

You can use the Native Messaging API. Password Managers used to use a localhost listener, but it's less safe than Native Messaging. But if you stick with the HTTP listener, as someone else mentioned, while you're installing your app, you can edit the user's host file to add a domain name to the loopback adapter, and then you can also create a one-off SSL cert for the computer.

jcoffland 8y ago
Thanks, I did not know about Native Messaging API. Unfortunately it appears to be only supported by Chrome.
- amaccuish 8y ago
  Hi there. Sorry I'm a bit late, but Firefox definitely supports native messaging with their new WebExtensions architecture; the extension I use with my Estonian ID card uses native message to talk to a native component, which in turn talks to my card.