25 ms·

It will still work on localhost, which is nice. It would be nice if it also worked on local IPs, like 192.168... Those do not work on Chrome, I think, which mak

It will still work on localhost, which is nice. It would be nice if it also worked on local IPs, like 192.168... Those do not work on Chrome, I think, which make mobile testing a bit more cumbersome.

nhumrich 7y ago
You could add a tunnel via iptables to just route one port on localhost to another ip
- klodolph 7y ago
  iptables on your phone? I think you would need to root your phone, if it's Android.
  - lucb1e 7y ago
    I think it's not unreasonable for a techie to be the admin of their own phone. (I still don't get how this is an unpopular opinion.)
    - deleted 7y ago
      [deleted]
    - klodolph 7y ago
      I also think it’s not unreasonable to not want to have root access to your phone.
    - untog 7y ago
      > (I still don't get how this is an unpopular opinion.) Not unpopular, just unrealistic. You can't do it on an iPhone, and if you're doing local web development you really ought to be checking it on an iPhone.
      - rswail 7y ago
        If you're doing local web development, then running the iOS simulator will give you the necessary Safari iOS Web view controls.
        untog 7y ago
        It won't get you the necessary touch interactions if you're doing something that uses them, though. Broadly speaking, you want to test on the actual device your users are using, not an approximation of one.
    - chipperyman573 7y ago
      If you have a OnePlus (which come more or less rooted) or a Samsung (Which has a lot of community support), you can probably root it pretty easily. But a lot of other phones lack the manufacturer's blessing or the community's support, leaving you SOL unless you can find an exploit yourself. Also... iphone?
    - kalleboo 7y ago
      As I get older and get other responsibilities, I want to be admin of fewer and fewer things. Same reason I replaced my Linux fileserver with a Synology. I'll let someone else stay on top of the security issue du jour.
  - Groxx 7y ago
    Probably possible with a local VPN on android? I believe those can do anything they please.
  - numtel 7y ago
    No need to root, with android in developer mode, run this to forward localhost:3000 to the same port on the phone. > adb reverse tcp:3000 tcp:3000
varenc 7y ago
For local development, Chrome has a flag that lets you force specific origins to be treated as secure: chrome://flags/#unsafely-treat-insecure-origin-as-secure I don't think Firefox has anything equivalent though? This bug on the topic is unassigned: https://bugzilla.mozilla.org/show_bug.cgi?id=1410365 https://bugzilla.mozilla.org/show_bug.cgi?id=1410365
- mort96 7y ago
  I don't imagine that works on mobile chrome, which is what the parent comment was talking about.
  - _fzslm 7y ago
    It does, on Android.
    - mort96 7y ago
      Ah, TIL. Though it doesn't work on iOS Chrome, and you want to test on iOS too obviously.
      - deleted 7y ago
        [deleted]
      - Wowfunhappy 7y ago
        iOS Chrome is just Safari with a Google skin, Google has no control over this type of thing.
        mort96 7y ago
        That's both true and completely irrelevant.
        Wowfunhappy 7y ago
        Well, it's relevant insofar as you're complaining to the wrong company. Does this behavior even exists in iOS Chrome? If it does, it exists in Mobile Safari as well.
hannob 7y ago
> It would be nice if it also worked on local IPs, like 192.168... That would defeat the security purpose. Anyone within your local network (which practically speaking very often means the next Wifi your device could find) could attack you.
- mort96 7y ago
  But how do you do local development when you can't get an SSL cert for your dev machine's server? No, self signed certs don't always do what you need, especially on mobile where you can't just add your cert as a trusted cert easily.
  - yeukhon 7y ago
    I know localhost is supported by Lets Encrypt but not sure about local lan network. One possible workaround is ssh forwarding. Create a tunnel. But I have not tried it myself.
  - comex 7y ago
    If you own a domain, you can add a subdomain that points to the local network IP, and get Let's Encrypt to give you a certificate using the dns-01 validation method (which doesn't require Let's Encrypt to actually access the IP address in the A record). This is clearly more complicated than ideal, but it should work. Edit: You can also use a custom CA root certificate, which can be installed on iOS etc. mkcert is a good starting point: https://github.com/FiloSottile/mkcert https://github.com/FiloSottile/mkcert
    - mort96 7y ago
      > This is clearly more complicated than ideal, but it should work. Exactly. Imagine you're someone who just wants to play around with cool web technologies. Maybe you're fairly new to web dev; maybe you're fairly new to the world of programming in general and you're using the web to learn it, which has historically been one of the huge strengths of the web. You suddenly encounter a brick wall, where you figure out that programming isn't enough; you have to fork over money for a domain and learn how SSL works and how to set up let's encrypt and how to make root certs and how to install them on your phone, just because you wanted to play with something you found interesting. The web looks like it's going away from being a good platform to learn and play with programming in the name of security. It will be annoying but workable for most professional programmers who can just do whatever hacks they need to get by, but we're erecting some monumental barriers to learn this stuff. You already can't even include a fucking javascript module file from an html file without learning how to set up and configure a web server because Chrome blocks modules when using file://.
vortico 7y ago
It's fantastic that it works with localhost (and I assume 127.0.0.1?), and it's fantastic that it doesn't work with anything else. This is the best middleground.
- mort96 7y ago
  When it doesn't work on anything other than localhost, you can't host a web server on your dev machine and test how it works on your phone. I've been through the hell of trying to test WebRTC applications on mobile Safari, and it's horrible. Specifically, you need HTTPS for WebRTC, but you obviously have to use a self signed cert because local IP. You can ignore the cert error and load the page, but connecting to the websocket for signaling will still fail because websocket on iOS requires a non-self-signed cert. Non-HTTPS websocket would work, but not from a HTTPS host. So you're in a situation where you need HTTPS due to WebRTC, but you can't use HTTPS due to websockets. In trying to push people to HTTPS by disabling features on HTTP, we're making development a _much_ worse experience. I'm not sure that's right.
  - vortico 7y ago
    I see your point about mobile testing. (I don't do mobile work, so I didn't think of it.)
  - Mister_Snuggles 7y ago
    You can probably just create your own root CA and install it on your mobile device for testing. I've done this for my internal stuff at home and it works well. I use xca[0] to create/manage the root CA and the certificates, but there are other tools to do this. [0] https://hohnstaedt.de/xca/ https://hohnstaedt.de/xca/
  - shkkmo 7y ago
    > you obviously have to use a self signed cert because local IP Not true at all, SSL certs have nothing to do with IP of the servers that use them, the servers just have to have the correct private key for that cert. You can make any domain point to local IPs by using the hosts file or even editing DNS directly.
wlesieutre 7y ago
Mozilla’s previous blog post on the topic says > Mozilla will provide developer tools to ease the transition to secure contexts and enable testing without an HTTPS server. https://blog.mozilla.org/security/2018/01/15/secure-contexts-everywhere/ https://blog.mozilla.org/security/2018/01/15/secure-contexts... But the bugzilla entry they linked to with that has been unassigned for two years, so maybe they changed their minds or figure the localhost exception is sufficient. https://bugzilla.mozilla.org/show_bug.cgi?id=1410365 https://bugzilla.mozilla.org/show_bug.cgi?id=1410365 The last comment proposes a whitelist for development domains, but no response to it.
- webstudio 7y ago
  for easy bypass this guard - ( for rapid development / testing ) - and dont have a localhost environment ths helped me (with the 68.0 win edition): about:config set the media.getusermedia.insecure.enabled from false to true
  - wlesieutre 7y ago
    Good to know! I'm leaving it alone on my main FF installation, but I've set that in Developer Edition.
    - webstudio 7y ago
      on the developer-edition 69.0b3 it didn´t work - may there are some more flags needed. But on the normal edition 68.0 it worked / it is actually working.
peterlk 7y ago
To any browser developers out there, I beg you, please, please, please whitelist lvh.me. I am so tired of security restrictions making everything painful for lvh.me.
- tty2300 7y ago
  Why? That is just an ordinary domain name that someone pointed at local host. I don't see why it should get any security exemptions.
- missblit 7y ago
  But nothing ensures that domain name will always point to localhost. So why should browsers trust it more than other HTTP domains? It's owned by one person, so DNS registration could lapse even with the best intentions.
iwalton3 7y ago
I wrote a script a while ago that automatically creates a subdomain on a domain I own and registers a Let’s Encrypt certificate for this exact purpose. I’ve found it very useful as it will work even for local addresses and dynamic addresses. (It will update the dns record and renew the cert on futher invocations.) I do wish there was a public solution offering this type of easy dynamic DNS with https. (Sharing the script I wrote could cost a lot on dns hosting and increased server expenses.)
k_bx 7y ago
Is generating localhost certs and then accepting them in your browser once is that hard? openssl genrsa -out key.pem 2048 openssl req -new -key key.pem -out certificate.csr openssl x509 -req -in certificate.csr -signkey key.pem -out certificate.pem
- baq 7y ago
  if all development servers for all frameworks just did that on first run of a project it'd be so much easier.
  - k_bx 7y ago
    I just stopped using languages that require a "framework" or "development server" with monster json/yaml configurations to run a web server. In Haskell, a change from http to https is switching from warp.run to warp-tls.runTLS function (with certificate paths set).
deleted 7y ago
[deleted]
mercora 7y ago
in order to replicate or simulate a production environment i sometimes do something like this: ip route add local 192.0.2.123/32 table local dev lo which makes your system act like this is a local address without actually being one. EDIT: nvm i just realized that wont solve your issues with mobile development...

It will still work on localhost, which is nice. It would be nice if it also worked on local IPs, like 192.168... Those do not work on Chrome, I think, which make mobile testing a bit more cumbersome.

nhumrich 7y ago

You could add a tunnel via iptables to just route one port on localhost to another ip

klodolph 7y ago
iptables on your phone? I think you would need to root your phone, if it's Android.
- lucb1e 7y ago
  I think it's not unreasonable for a techie to be the admin of their own phone. (I still don't get how this is an unpopular opinion.)
  - deleted 7y ago
    [deleted]
  - klodolph 7y ago
    I also think it’s not unreasonable to not want to have root access to your phone.
  - untog 7y ago
    > (I still don't get how this is an unpopular opinion.) Not unpopular, just unrealistic. You can't do it on an iPhone, and if you're doing local web development you really ought to be checking it on an iPhone.
    - rswail 7y ago
      If you're doing local web development, then running the iOS simulator will give you the necessary Safari iOS Web view controls.
      - untog 7y ago
        It won't get you the necessary touch interactions if you're doing something that uses them, though. Broadly speaking, you want to test on the actual device your users are using, not an approximation of one.
  - chipperyman573 7y ago
    If you have a OnePlus (which come more or less rooted) or a Samsung (Which has a lot of community support), you can probably root it pretty easily. But a lot of other phones lack the manufacturer's blessing or the community's support, leaving you SOL unless you can find an exploit yourself. Also... iphone?
  - kalleboo 7y ago
    As I get older and get other responsibilities, I want to be admin of fewer and fewer things. Same reason I replaced my Linux fileserver with a Synology. I'll let someone else stay on top of the security issue du jour.
- Groxx 7y ago
  Probably possible with a local VPN on android? I believe those can do anything they please.
- numtel 7y ago
  No need to root, with android in developer mode, run this to forward localhost:3000 to the same port on the phone. > adb reverse tcp:3000 tcp:3000

varenc 7y ago

For local development, Chrome has a flag that lets you force specific origins to be treated as secure: chrome://flags/#unsafely-treat-insecure-origin-as-secure I don't think Firefox has anything equivalent though? This bug on the topic is unassigned: https://bugzilla.mozilla.org/show_bug.cgi?id=1410365 https://bugzilla.mozilla.org/show_bug.cgi?id=1410365

mort96 7y ago
I don't imagine that works on mobile chrome, which is what the parent comment was talking about.
- _fzslm 7y ago
  It does, on Android.
  - mort96 7y ago
    Ah, TIL. Though it doesn't work on iOS Chrome, and you want to test on iOS too obviously.
    - deleted 7y ago
      [deleted]
    - Wowfunhappy 7y ago
      iOS Chrome is just Safari with a Google skin, Google has no control over this type of thing.
      - mort96 7y ago
        That's both true and completely irrelevant.
        Wowfunhappy 7y ago
        Well, it's relevant insofar as you're complaining to the wrong company. Does this behavior even exists in iOS Chrome? If it does, it exists in Mobile Safari as well.

hannob 7y ago

> It would be nice if it also worked on local IPs, like 192.168... That would defeat the security purpose. Anyone within your local network (which practically speaking very often means the next Wifi your device could find) could attack you.

mort96 7y ago
But how do you do local development when you can't get an SSL cert for your dev machine's server? No, self signed certs don't always do what you need, especially on mobile where you can't just add your cert as a trusted cert easily.
- yeukhon 7y ago
  I know localhost is supported by Lets Encrypt but not sure about local lan network. One possible workaround is ssh forwarding. Create a tunnel. But I have not tried it myself.
- comex 7y ago
  If you own a domain, you can add a subdomain that points to the local network IP, and get Let's Encrypt to give you a certificate using the dns-01 validation method (which doesn't require Let's Encrypt to actually access the IP address in the A record). This is clearly more complicated than ideal, but it should work. Edit: You can also use a custom CA root certificate, which can be installed on iOS etc. mkcert is a good starting point: https://github.com/FiloSottile/mkcert https://github.com/FiloSottile/mkcert
  - mort96 7y ago
    > This is clearly more complicated than ideal, but it should work. Exactly. Imagine you're someone who just wants to play around with cool web technologies. Maybe you're fairly new to web dev; maybe you're fairly new to the world of programming in general and you're using the web to learn it, which has historically been one of the huge strengths of the web. You suddenly encounter a brick wall, where you figure out that programming isn't enough; you have to fork over money for a domain and learn how SSL works and how to set up let's encrypt and how to make root certs and how to install them on your phone, just because you wanted to play with something you found interesting. The web looks like it's going away from being a good platform to learn and play with programming in the name of security. It will be annoying but workable for most professional programmers who can just do whatever hacks they need to get by, but we're erecting some monumental barriers to learn this stuff. You already can't even include a fucking javascript module file from an html file without learning how to set up and configure a web server because Chrome blocks modules when using file://.

vortico 7y ago

It's fantastic that it works with localhost (and I assume 127.0.0.1?), and it's fantastic that it doesn't work with anything else. This is the best middleground.

mort96 7y ago
When it doesn't work on anything other than localhost, you can't host a web server on your dev machine and test how it works on your phone. I've been through the hell of trying to test WebRTC applications on mobile Safari, and it's horrible. Specifically, you need HTTPS for WebRTC, but you obviously have to use a self signed cert because local IP. You can ignore the cert error and load the page, but connecting to the websocket for signaling will still fail because websocket on iOS requires a non-self-signed cert. Non-HTTPS websocket would work, but not from a HTTPS host. So you're in a situation where you need HTTPS due to WebRTC, but you can't use HTTPS due to websockets. In trying to push people to HTTPS by disabling features on HTTP, we're making development a _much_ worse experience. I'm not sure that's right.
- vortico 7y ago
  I see your point about mobile testing. (I don't do mobile work, so I didn't think of it.)
- Mister_Snuggles 7y ago
  You can probably just create your own root CA and install it on your mobile device for testing. I've done this for my internal stuff at home and it works well. I use xca[0] to create/manage the root CA and the certificates, but there are other tools to do this. [0] https://hohnstaedt.de/xca/ https://hohnstaedt.de/xca/
- shkkmo 7y ago
  > you obviously have to use a self signed cert because local IP Not true at all, SSL certs have nothing to do with IP of the servers that use them, the servers just have to have the correct private key for that cert. You can make any domain point to local IPs by using the hosts file or even editing DNS directly.

wlesieutre 7y ago

Mozilla’s previous blog post on the topic says > Mozilla will provide developer tools to ease the transition to secure contexts and enable testing without an HTTPS server. https://blog.mozilla.org/security/2018/01/15/secure-contexts-everywhere/ https://blog.mozilla.org/security/2018/01/15/secure-contexts... But the bugzilla entry they linked to with that has been unassigned for two years, so maybe they changed their minds or figure the localhost exception is sufficient. https://bugzilla.mozilla.org/show_bug.cgi?id=1410365 https://bugzilla.mozilla.org/show_bug.cgi?id=1410365 The last comment proposes a whitelist for development domains, but no response to it.

webstudio 7y ago
for easy bypass this guard - ( for rapid development / testing ) - and dont have a localhost environment ths helped me (with the 68.0 win edition): about:config set the media.getusermedia.insecure.enabled from false to true
- wlesieutre 7y ago
  Good to know! I'm leaving it alone on my main FF installation, but I've set that in Developer Edition.
  - webstudio 7y ago
    on the developer-edition 69.0b3 it didn´t work - may there are some more flags needed. But on the normal edition 68.0 it worked / it is actually working.

peterlk 7y ago

To any browser developers out there, I beg you, please, please, please whitelist lvh.me. I am so tired of security restrictions making everything painful for lvh.me.

tty2300 7y ago
Why? That is just an ordinary domain name that someone pointed at local host. I don't see why it should get any security exemptions.
missblit 7y ago
But nothing ensures that domain name will always point to localhost. So why should browsers trust it more than other HTTP domains? It's owned by one person, so DNS registration could lapse even with the best intentions.

iwalton3 7y ago

I wrote a script a while ago that automatically creates a subdomain on a domain I own and registers a Let’s Encrypt certificate for this exact purpose. I’ve found it very useful as it will work even for local addresses and dynamic addresses. (It will update the dns record and renew the cert on futher invocations.) I do wish there was a public solution offering this type of easy dynamic DNS with https. (Sharing the script I wrote could cost a lot on dns hosting and increased server expenses.)

k_bx 7y ago

Is generating localhost certs and then accepting them in your browser once is that hard? openssl genrsa -out key.pem 2048 openssl req -new -key key.pem -out certificate.csr openssl x509 -req -in certificate.csr -signkey key.pem -out certificate.pem

baq 7y ago
if all development servers for all frameworks just did that on first run of a project it'd be so much easier.
- k_bx 7y ago
  I just stopped using languages that require a "framework" or "development server" with monster json/yaml configurations to run a web server. In Haskell, a change from http to https is switching from warp.run to warp-tls.runTLS function (with certificate paths set).

deleted 7y ago

[deleted]

mercora 7y ago

in order to replicate or simulate a production environment i sometimes do something like this: ip route add local 192.0.2.123/32 table local dev lo which makes your system act like this is a local address without actually being one. EDIT: nvm i just realized that wont solve your issues with mobile development...