{"action":"created","issue":{"url":"https://api.github.com/repos/electron/electron/issues/6222","repository_url":"https://api.github.com/repos/electron/electron","labels_url":"https://api.github.com/repos/electron/electron/issues/6222/labels{/name}","comments_url":"https://api.github.com/repos/electron/electron/issues/6222/comments","events_url":"https://api.github.com/repos/electron/electron/issues/6222/events","html_url":"https://github.com/electron/electron/issues/6222","id":162082279,"number":6222,"title":"Support for whitelisting domains that are allowed certificate errors","user":{"login":"dteirney","id":406446,"avatar_url":"https://avatars.githubusercontent.com/u/406446?v=3","gravatar_id":"","url":"https://api.github.com/users/dteirney","html_url":"https://github.com/dteirney","followers_url":"https://api.github.com/users/dteirney/followers","following_url":"https://api.github.com/users/dteirney/following{/other_user}","gists_url":"https://api.github.com/users/dteirney/gists{/gist_id}","starred_url":"https://api.github.com/users/dteirney/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dteirney/subscriptions","organizations_url":"https://api.github.com/users/dteirney/orgs","repos_url":"https://api.github.com/users/dteirney/repos","events_url":"https://api.github.com/users/dteirney/events{/privacy}","received_events_url":"https://api.github.com/users/dteirney/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2016-06-24T06:04:55Z","updated_at":"2016-06-24T07:11:12Z","closed_at":null,"body":"* Electron version: latest\r\n* Operating system: Windows\r\n\r\nHello. We have an Electron based web application that needs to connect to both our backend RESTful APIs over the open internet using HTTPS, e.g. https://example.com/path/to/api, AND to RESTful APIs running on the Windows desktop on localhost, e.g. http://localhost:12345/path/to/api. The localhost RESTful APIs are currently not using HTTPS (if someone malicious has managed to compromise localhost then we assume it's game over anyway).\r\n\r\nThis type of access to HTTP APIs from an HTTPS web page isn't possible due to the Mixed Content protection that Chromium provides out of the box (the base text/html pages calling the APIs using fetch are served via HTTPS from our backend accessed over the open internet).\r\n\r\nTo workaround this we have tried using HTTPS on localhost with a self-signed certificate as it's not possible to get a proper SSL certificate for localhost signed by a root CA. To get this to work we've turned off certificate errors using --ignore-certificate-errors. However, we can't ship like this as we'd then be vulnerable to a man-in-the-middle attack for the HTTPS content being accessed over the open internet.\r\n\r\nWe tried allowing access to http://localhost with a Content-Security-Policy but it seems that isn't possible.\r\n\r\nOne thing that might be useful for this scenario would be the ability to whitelist domains where a certificate error is allowed, rather than a simple on/off switch for certificate errors. Is this something that might be feasible to add to Electron? We found discussion about this at https://discuss.atom.io/t/trusting-a-self-signed-certificate/12332 but there wasn't any resolution noted.\r\n\r\nAre there any other options that might be straight forward for us to implement to resolve this problem? If we could add a certificate to the certificate trust store used by Electron / Chromium we could probably get something to work using that.\r\n\r\nThanks!\r\nDavid"},"comment":{"url":"https://api.github.com/repos/electron/electron/issues/comments/228273878","html_url":"https://github.com/electron/electron/issues/6222#issuecomment-228273878","issue_url":"https://api.github.com/repos/electron/electron/issues/6222","id":228273878,"user":{"login":"MarshallOfSound","id":6634592,"avatar_url":"https://avatars.githubusercontent.com/u/6634592?v=3","gravatar_id":"","url":"https://api.github.com/users/MarshallOfSound","html_url":"https://github.com/MarshallOfSound","followers_url":"https://api.github.com/users/MarshallOfSound/followers","following_url":"https://api.github.com/users/MarshallOfSound/following{/other_user}","gists_url":"https://api.github.com/users/MarshallOfSound/gists{/gist_id}","starred_url":"https://api.github.com/users/MarshallOfSound/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MarshallOfSound/subscriptions","organizations_url":"https://api.github.com/users/MarshallOfSound/orgs","repos_url":"https://api.github.com/users/MarshallOfSound/repos","events_url":"https://api.github.com/users/MarshallOfSound/events{/privacy}","received_events_url":"https://api.github.com/users/MarshallOfSound/received_events","type":"User","site_admin":false},"created_at":"2016-06-24T07:11:12Z","updated_at":"2016-06-24T07:11:12Z","body":"Oh, here's a neat solution based on this API\r\n\r\nhttps://github.com/electron/electron/blob/master/docs/api/app.md#event-certificate-error\r\n\r\n```js\r\napp.on('certificate-error', (event, webContents, url, error, certificate, callback) => {\r\n  if (/https:\\/\\/localhost/g.test(url)) {\r\n    // Verification logic.\r\n    event.preventDefault();\r\n    callback(true);\r\n  } else {\r\n    callback(false);\r\n  }\r\n});\r\n```"}}
{"actor":{"display_login":"MarshallOfSound"}}