authgear / authgear/authgear-server

Return more friendly error message in SDK if HTTPS/secure contexts is not in used

Open
#4,162 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
2k
Forks
125
Avg merge
2d 17h
Merged PRs (30d)
32

Description

## Problem

The SDK uses a browser API [SubtleCrypto: digest()](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/digest) that requires HTTPS.
If HTTPS cannot be enabled in the environment,
"secure contexts" can be used - [see MDN doc](https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts#when_is_a_context_considered_secure), i.e. *127.0.0.1, localhost or \*.localhost*

If HTTP is used with the SDK, developers will encounter errors in their browser and cannot initialize authentication.

Our SDKs now do not handle this specific error and a raw error from the browser is shown, which is very difficult for the developers to understand what happened and how to solve the issue.

## Solution

Detect this error and throw a better error message, and point to our an article about this issue in the doc

The error message should be like

> window.crypto.subtle is only available in secure contexts (HTTPS). For details, please visit \[link to our doc\]


and then in our doc page, we tell the user the actionable (use HTTPS, or localhost), with some reference to MDN [https://developer.mozilla.org/en-US/docs/Web/API/Crypto/subtle](https://developer.mozilla.org/en-US/docs/Web/API/Crypto/subtle) and [https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts](https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts)

Contributor guide

Open the contributing guide

Research direction

Locate the browser SDK initialization path where SubtleCrypto.digest() is used and first reproduce the failure over HTTP. Add a clearer secure-context error with a documentation link, then verify that HTTPS, localhost, and 127.0.0.1 remain supported and that the documentation explains the actionable fixes with the supplied MDN references.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
authentication, frontend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.