New issue
Advanced search Search tips

Issue 732029 link

Starred by 1 user
Status: WontFix
Owner: ----
Closed: Jun 2017
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug-Regression



Sign in to add a comment

Crypto.subtle is missing for localhost TLD

Reported by jferl...@gmail.com, Jun 10 2017 
UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.20 Safari/537.36

Steps to reproduce the problem:
1. Create a web page hosted on your local machine with the content document.write(window.crypto.subtle)
2. Load this using the following URLs
  * http://127.0.0.1
  * http://localhost
  * http://dev/localhost

What is the expected behavior?
Expect all the URLs to return a page with [object SubtleCrypto]

What went wrong?
The last page returns undefined

It looks like there is some sort of different treatment with the localhost TLD with respect to the crypto library.

Did this work before? Yes I know it works in 58.0.3029.110 and doesn't in 60.0.3112.20

Does this work in other browsers? Yes

Chrome version: 60.0.3112.20  Channel: dev
OS Version: Ubuntu 16.04
Flash Version:

Comment 1 by rsleevi@chromium.org, Jun 11 2017

Status: WontFix (was: Unconfirmed)
WebCrypto is restricted to SecureOrigin.

In Firefox, localhost is being treated as a secure origin in the latest versions. Chrome does not do that.

In Edge, Web Crypto is not yet following the spec restricting to SecureOrigin, AIUI.

This is working as specified.

Comment 2 by jferl...@gmail.com, Jun 12 2017 

In my example though I'm seeing different behaviour from
  * http://127.0.0.1 - crypto.subtle exists
  * http://localhost - crypto.sublte exists
  * http://dev.localhost - crypto.subtle DOES NOT exist

This seems inconsistent.

If I use https then crypto.subtle works for all three.

I assume 127.0.0.1 and localhost are a special case and crypto.subtle is allowed even over HTTP, so should *.localhost be allowed as well given the way it works on chrome?

Comment 3 by silviapf...@gmail.com, Jun 12 2017 

Please note the typo in the original bug report and re-assess.

Comment 4 by rsleevi@chromium.org, Jun 12 2017 

No. It is not expected to work.

https://w3c.github.io/webappsec-secure-contexts/#localhost

Comment 5 by jferl...@gmail.com, Jun 12 2017 

Should I file a new bug to make crypto not work on all localhost variants?
►

Sign in to add a comment