Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make server host pages securely using self-signed certificate #717

Open
jvens opened this issue Mar 8, 2024 · 1 comment
Open

Make server host pages securely using self-signed certificate #717

jvens opened this issue Mar 8, 2024 · 1 comment
Labels
enhancement New feature or request Local

Comments

@jvens
Copy link

jvens commented Mar 8, 2024

Is your feature request related to a problem? Please describe.
Currently all of the pages are served using HTTP instead of HTTPS. Honestly this is fine for most aspects of this system, but it does create a couple of issues, is not the most secure, and may cause big issues in the future.

As an example of where this is a problem, I have created a tool to connect the WebSocket from the FTC Live API to OBS Studio. It works well and having it hosted on the cloud makes it easy for different events to use it at the same time without needing to run special software. The problem is it currently only works if run from the same computer that is running the score system and OBS studio because if FTC Live is on a different computer Chrome blocks the WebSocket connection because of Mixed Content (full error message at the bottom).

I have run into this limitation in other places as well, and Google through Chrome is really strongly pushing everything towards HTTPS and keeps removing HTTP features and will likely eventually succeed in completely blocking HTTP (they have been trying to do this for at least the last 4 years now).

Describe the solution you'd like
Have the system generate and use a self-signed SSL certificate. This can be done along with #664 to have an easy-to-use domain name and eliminate the need for using IP addresses to access the system.

Describe alternatives you've considered
Keep hosting everything via HTTP and hope that Chrome/Mozilla don't break any features the system relies upon, and keep working around the issues with third-party tools.

Additional context

Mixed Content: The page at 'https://obs.vens.co/' was loaded over HTTPS, but requested an insecure resource 'http://192.168.102.52/api/v1/events/'. This request has been blocked; the content must be served over HTTPS.
@jvens
Copy link
Author

jvens commented Mar 8, 2024

This would also require the change mentioned in #685 which is currently a workaround to add this feature since it isn't currently built into the system.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request Local
Projects
None yet
Development

No branches or pull requests

1 participant