Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Treat localhost as secure context #514

Merged
merged 5 commits into from
Jul 10, 2024
Merged

Treat localhost as secure context #514

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
ca7af13
treat *.localhost/127.0.0.1 as secure
iTrooz Jun 14, 2024
adda778
comment about isSecureContext
iTrooz Jun 14, 2024
574c441
clarify comment about PWA security
iTrooz Jun 14, 2024
bf89f13
fix linting
iTrooz Jun 14, 2024
658b0c3
Slightly change the comment wording
filips123 Jul 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 11 additions & 2 deletions extension/src/background.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,12 @@ browser.notifications.onClicked.addListener(async notification => {

// == CONTENT SCRIPT HANDLING

// Check if the URL is considered a secure context
// Docs: https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts
function isSecureURL (url) {
return url.protocol === 'https:' || url.hostname === '127.0.0.1' || url.hostname === 'localhost' || url.hostname.endsWith('.localhost')
}

// Detect manifest sent from content script
browser.runtime.onMessage.addListener(async ({ manifestUrl, documentUrl, isSecureContext }, { tab }) => {
manifestUrl = manifestUrl ? new URL(manifestUrl) : undefined
Expand All @@ -58,8 +64,11 @@ browser.runtime.onMessage.addListener(async ({ manifestUrl, documentUrl, isSecur
return
}

// If both manifest and the page are loaded over HTTPS, and we are in a secure context, site is a valid web app
let isValidPwa = manifestUrl && manifestUrl.protocol === 'https:' && documentUrl.protocol === 'https:' && isSecureContext
// Check if the web app is loaded over a secure context
// We do this through checking the URLs for https, or for special hosts (e.g. localhost)
// We also check the browser implementation of secure context with `isSecureContext`, just in case
// If both the document and the current page pass these checks, the site is a valid web app
let isValidPwa = manifestUrl && isSecureURL(manifestUrl) && isSecureURL(documentUrl) && isSecureContext

// Force show or hide the page action depending on user preference
const settingsDisplayPageAction = (await browser.storage.local.get(PREF_DISPLAY_PAGE_ACTION))[PREF_DISPLAY_PAGE_ACTION]
Expand Down