Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use valid cert for HTTPS in development #3441

Closed
radi-cho opened this issue Nov 11, 2017 · 7 comments
Closed

Use valid cert for HTTPS in development #3441

radi-cho opened this issue Nov 11, 2017 · 7 comments

Comments

@radi-cho
Copy link

radi-cho commented Nov 11, 2017

Is this a bug report?

No. This is a question (for now) or discussion.

Which terms did you search for in User Guide?

HTTPS

Environment

  1. OS: Windows 10
  2. node -v: 8.4.0
  3. yarn --version: 0.27.5/1.0.0
  4. I haven’t ejected
  5. Browser: Chrome 62

Steps to Reproduce:

  1. Create a project
  2. Run: 'set HTTPS=true&&yarn start' (or npm start)
  3. Open https://localhost:3000 in the browser

Expected Behavior

Safe and secure HTTPS connection

Actual Behavior

Error message:

Your connection is not private

image

Main Question:

What I'm doing wrong and how to open secure connection without seeing errors or "unsafe connection warnings"?

@radi-cho
Copy link
Author

radi-cho commented Nov 11, 2017

I fixed this in very interesting and tricky way:

  1. First I exported certificate from chrome (view this).
  2. Imported the certificate into Windows (using certmgr.msc).
  3. Allowed chrome://flags/#allow-insecure-localhost flag. - https://goo.gl/VBV6uR

And it works! Thanks to Samet Karaibryamov
image

The most interesting is that 1 and 2 can't fix the security error without 3 and 3 can't without 1 and 2.

@radi-cho radi-cho changed the title Question: HTTPS - Your connection is not private Question/Discussion: Your HTTPS connection is not private Nov 11, 2017
@Dubes
Copy link
Contributor

Dubes commented Nov 14, 2017

Out of curiosity: Why is this needed?
My (random) thoughts:

  • The warning is correct, as the certificate is not signed by a CA.
  • npm run start should be used only for development and for that http should suffice
  • When we deploy to an environment any other user wants to access, we should ensure proper certificates are in place.

@radi-cho
Copy link
Author

radi-cho commented Nov 14, 2017

@Dubes I know all of these things, but... Google wants it. I requested verification request for using OAuth.

Dear Developer,
According to our information the following redirect URIs are not encrypted and secure.
 
post_message_origins: "http://localhost"
post_message_origins: "http://localhost:5000"

Please ensure your redirect URIs are encrypted and secure to ensure data theft does not take place.
It can be done by using an HTTPS protocol (a secure, encrypted connection).
Please reply back once you have updated all your redirect URIs for us to proceed with the verification process.

Sincerely,
Google Cloud Platform/API Trust & Safety

@Timer
Copy link
Contributor

Timer commented Nov 14, 2017

I'm not sure this is in scope of our project to fix, but I'm more than happy to accept a pull request and have some discussion about a possible solution for this.

Google shouldn't care if the cert isn't valid, I notice your error message says http:// and not https://, so maybe that's your problem?

It's going to be pretty low priority for us since you're the first to run into it (sorry!).

@radi-cho
Copy link
Author

Yeah, you can add label priority: low, but please keep this open for discussion.
I'll try to learn more and if I can will open PR.

@Timer Timer changed the title Question/Discussion: Your HTTPS connection is not private Use valid cert for HTTPS in development Nov 14, 2017
@gaearon
Copy link
Contributor

gaearon commented Jan 8, 2018

Closing as stale.

@gaearon gaearon closed this as completed Jan 8, 2018
@orlowang
Copy link

@Dubes you may use free CA like other js-lib do. I develop electron app, it can't open https://localhost:3000 if it has a invalid certificate, and, yes, use http can make it work, but it will be better as is support.

@lock lock bot locked and limited conversation to collaborators Jan 19, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

5 participants