apache / apache/cordova-browser

Serve over HTTPS

Open
#122 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
174
Forks
86
Avg merge
8h 15m
Merged PRs (30d)
6

Description

# Feature Request

## Motivation Behind Feature

In some development environments, an API is served over SSL via the protocol `https`. Communicating with that API from a Cordova browser instance on a developer's machine is very efficient work flow. However, modern browsers disallow cross-origin communications between insecure and secured servers. In this case, the secured server is the API, and the insecure server is the current cordova-browser instance served with Node's `http` module. This is because it is always served without SSL.

I do not intend for this to be used in production environments, though there is no encoded limitation on its usage within this proposal.

## Feature Description

A new option `--https` would be added to the command `cordova run browser` --> `cordova run browser --https`. The default option is false.

When this option is present, the node module `https` will be used to construct the server. The server accepts a keyfile and certificate, whose provision is the responsibility of the user.

When this option is not present, the current node module `http` is used. Also, the `projectURL` used in opening a browser window likewise switches based on the `--https` option.

A user choosing this option is most likely to see a warning page in the browser while opening the Cordova browser index.html. They merely need to accept the warning to continue onwards to their Cordova project's index page.

#89 first proposed this, but was rejected and is currently closed. I have implemented this locally, and it works well.

## Alternatives or Workarounds

Exposing the API over non-secure http is an alternative. In my context, this was rejected strongly for security reasons, especially relating to corporate security accountability programs.

The second is that a developer independently hacks their local cordova installation to enable https. This is suboptimal since upgrading becomes a hassle, requiring careful VCS audits to restore erased, custom code.

Contributor guide

Open the contributing guide

Research direction

Start at the `cordova run browser` entry point and trace how the current Node `http` server and `projectURL` are selected. Review the requested `--https` switch, Node's `https` module, and the user-provided keyfile and certificate requirements; done means HTTPS opens the Cordova project while the existing HTTP behavior remains available.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, nodejs
Domain
backend, cli, web-dev
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.