Library requires https on localhost in development #30

Activity

1. taneltm commented on Nov 10, 2022

   

   taneltm

   on Nov 10, 2022

   Member

   More actions

   I agree, it would make development and testing easier.

   Both the library and the extension check for Secure Context, which makes an exception for locally-delivered resources.

   Locally-delivered resources such as those with http://127.0.0.1 URLs, http://localhost and http://*.localhost URLs (e.g. http://dev.whatever.localhost/), and file:// URLs are also considered to have been delivered securely.

   However, web-eid-app does not allow http://localhost and exits with ERR_WEBEID_NATIVE_FATAL.

   origin scheme has to be https or wss in src/controller/command-handlers/certificatereader.cpp:134:validateAndStoreOrigin

   As I see it, we could solve it in two ways:

   • Change web-eid-app to allows local origins without HTTPS
   • Make the extension lie about the origin in DEBUG mode and provide https://debug.localhost as the origin to web-eid-app.

   As a workaround, you can edit /web-eid-webextension/src/content/content.ts and replace all instances of event.origin with "https://localhost".

   👍React with 👍1Reacted by MysteriousNothing
2. taneltm commented on Jan 30, 2025

   

   taneltm

   on Jan 30, 2025

   Member

   More actions

   @tenor-dev , I'm sorry it took so long, but we finally have an open PR web-eid/web-eid-webextension#79 which will give you an option to use http://localhost.
   This feature is planned for the next extension release.
3. mrts commented on Jul 3, 2026

   

   mrts

   on Jul 3, 2026

   Member

   More actions

   HTTP support for localhost has been merged in the extension: web-eid/web-eid-webextension#102.

   The required changes in application code are here:

   • Java Add configuration for allowing http connection during development web-eid-authtoken-validation-java#81
   • .NET Add configuration for allowing http connection during development web-eid-authtoken-validation-dotnet#57
   • PHP Add configuration for allowing http connection during development web-eid-authtoken-validation-php#42

   Hope this helps!
4. mrts

   closed this as completedon Jul 3, 2026