Conversation
There was a problem hiding this comment.
I started to review this and encountered the HTTPS error that @OleksandrRoshchuk mentioned to me in Slack (screenshot below).
The reason that HTTP is required is because local.applura.app uses the .app TLD, which makes HTTPS mandatory.
I suggested the mkcert program as a convenient way to generate and trust a locally generated certificate. But it looks like the node.js version of the mkcert program does not automatically install the root certificate authority that it uses.
We need to either:
- figure out how to do that in this command
- consider whether it would be insane to hard-code a valid private key that we personally generate and maintain
- document how to install and use the standalone
mkcertprogram
1 is most preferable, 2 is acceptable if we're willing to accept the risk, 3 is least preferable because it's the most clunky developer experience.
The risk with #2 is that it could potentially be abused in a phishing attack if:
- Nobody realized that the domain is
local.applura.appinstead ofsomethingelse.applura.app - The attacker is able to serve the malicious site from
127.0.0.1(since that's where thelocal.applura.appArecord points)

No description provided.