3 ms·

You could create a local HTML file without a server for it.

kevincox 4y ago
Edit: This was a misreading, see child comments. You can't actually do this because file:// URLs are not considered a secure context and the Web Crypto API is only available in secure contexts: https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_... You would need to run a local webserver and access it over `localhost`.
- snowstormsun 4y ago
  Yeah, also thought so, but here it says "and file:// URLs are also considered to have been delivered securely." (https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts#when_is_a_context_considered_secure https://developer.mozilla.org/en-US/docs/Web/Security/Secure...). Am I missing something?
  - kevincox 4y ago
    Hmm, I must have misread that paragraph based on my expectation.
    - snowstormsun 4y ago
      But you're right. Just tried it and it told me: "Uncaught (in promise) DOMException: Public-key credentials are only available to HTTPS origin or HTTP origins that fall under 'localhost'. See https://crbug.com/824383 https://crbug.com/824383" Unfortunate :/
- nibdo 4y ago
  Some dirty solution can be spinning up home server just to download web app to your device and let service workers cache everything relevant. And then turn off server to prevent any updates to app. This is of course not very user friendly, but might have some use, if you can't or don't want to have running server 24/7 at your home or secure location. But I don't know, if any browser will let offline apps live for indefinite time. I was even playing with code signing web apps with help of service workers, which was not bullet proof, but better than nothing. Ultimately it failed on the fact, that you could not prevent/cache/block update of actual service worker file. Another dirty workaround could be using dynamic one time address for serving service worker only on first attempt and then browser would get 404 on attempts to update service worker. Again, not very useful as you are at mercy that browser won't just purge such "broken" worker.
  - snowstormsun 4y ago
    Another idea would be to use https://redbean.dev/ https://redbean.dev/ . For mobile it'd not work, though.

Edit: This was a misreading, see child comments. You can't actually do this because file:// URLs are not considered a secure context and the Web Crypto API is only available in secure contexts: https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_... You would need to run a local webserver and access it over `localhost`.

snowstormsun 4y ago
Yeah, also thought so, but here it says "and file:// URLs are also considered to have been delivered securely." (https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts#when_is_a_context_considered_secure https://developer.mozilla.org/en-US/docs/Web/Security/Secure...). Am I missing something?
- kevincox 4y ago
  Hmm, I must have misread that paragraph based on my expectation.
  - snowstormsun 4y ago
    But you're right. Just tried it and it told me: "Uncaught (in promise) DOMException: Public-key credentials are only available to HTTPS origin or HTTP origins that fall under 'localhost'. See https://crbug.com/824383 https://crbug.com/824383" Unfortunate :/
nibdo 4y ago
Some dirty solution can be spinning up home server just to download web app to your device and let service workers cache everything relevant. And then turn off server to prevent any updates to app. This is of course not very user friendly, but might have some use, if you can't or don't want to have running server 24/7 at your home or secure location. But I don't know, if any browser will let offline apps live for indefinite time. I was even playing with code signing web apps with help of service workers, which was not bullet proof, but better than nothing. Ultimately it failed on the fact, that you could not prevent/cache/block update of actual service worker file. Another dirty workaround could be using dynamic one time address for serving service worker only on first attempt and then browser would get 404 on attempts to update service worker. Again, not very useful as you are at mercy that browser won't just purge such "broken" worker.
- snowstormsun 4y ago
  Another idea would be to use https://redbean.dev/ https://redbean.dev/ . For mobile it'd not work, though.