authgear / authgear/authgear-server
Return more friendly error message in SDK if HTTPS/secure contexts is not in used
- Dominant language
- Go
- Stars
- 2k
- Forks
- 125
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 32
Description
## Problem
The SDK uses a browser API [SubtleCrypto: digest()](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/digest) that requires HTTPS.
If HTTPS cannot be enabled in the environment,
"secure contexts" can be used - [see MDN doc](https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts#when_is_a_context_considered_secure), i.e. *127.0.0.1, localhost or \*.localhost*
If HTTP is used with the SDK, developers will encounter errors in their browser and cannot initialize authentication.
Our SDKs now do not handle this specific error and a raw error from the browser is shown, which is very difficult for the developers to understand what happened and how to solve the issue.
## Solution
Detect this error and throw a better error message, and point to our an article about this issue in the doc
The error message should be like
> window.crypto.subtle is only available in secure contexts (HTTPS). For details, please visit \[link to our doc\]
and then in our doc page, we tell the user the actionable (use HTTPS, or localhost), with some reference to MDN [https://developer.mozilla.org/en-US/docs/Web/API/Crypto/subtle](https://developer.mozilla.org/en-US/docs/Web/API/Crypto/subtle) and [https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts](https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts)
Contributor guide
Research direction
Locate the browser SDK initialization path where SubtleCrypto.digest() is used and first reproduce the failure over HTTP. Add a clearer secure-context error with a documentation link, then verify that HTTPS, localhost, and 127.0.0.1 remain supported and that the documentation explains the actionable fixes with the supplied MDN references.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- authentication, frontend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100