Extensions using web views not working with self signed certificate #5671

Activity

1. jneuhauser

   added

   bugSomething isn't workingSomething isn't working

   triageThis issue needs to be triaged by a maintainerThis issue needs to be triaged by a maintainer

   on Oct 19, 2022
2. jsjoeio commented on Oct 19, 2022

   

   jsjoeio

   on Oct 19, 2022

   Contributor

   More actions

   @code-asher is this something we can fix or is this an issue outside code-server? I can't tell
3. jsjoeio

   added

   waiting-for-infoWaiting for more information from submitterWaiting for more information from submitter

   and removed

   bugSomething isn't workingSomething isn't working

   triageThis issue needs to be triaged by a maintainerThis issue needs to be triaged by a maintainer

   on Oct 19, 2022
4. code-asher commented on Oct 20, 2022

   

   code-asher

   on Oct 20, 2022 via email

   Member

   More actions

   I believe this is because Chrome always rejects invalid certificates for service workers even if you have accepted the prompt that warns you about the certificate. I think there are other browsers that will allow it (like Firefox, for now anyway). So it is not something we can fix unfortunately. If this is just temporary for testing Chrome could be launched with --ignore-certificate-errors. Otherwise the self-signed certificate will need to be made trusted. This could be done on the system level or in Chrome (there should be a place to import certificates somewhere).
5. code-asher commented on Oct 20, 2022

   

   code-asher

   on Oct 20, 2022

   Member

   More actions

   In the docs we recommend mkcert. Wonder if we can deprecate code-server's built-in certificate generator for that or at least add a warning to the output.

   👍React with 👍2Reacted by Joe Previte and Johann Neuhauser
6. jsjoeio commented on Oct 20, 2022

   

   jsjoeio

   on Oct 20, 2022

   Contributor

   More actions

   In the docs we recommend mkcert. Wonder if we can deprecate code-server's built-in certificate generator for that or at least add a warning to the output.

   Yeah that might be a good move overall. It would lead to less frustration IMO.
7. neurorepro commented on Oct 22, 2022

   

   neurorepro

   on Oct 22, 2022

   More actions

   Hello, this is actually happening for all the extensions I use and tested: Markdown preview, git history, git graph, and another one i can't remember.

   These extensions are essential in my case (course based on code server, which i find super useful) so any solution on how to fix this problem would be very helpful.

   Meanwhile even a code server version someone could rollback too (for which extensions are working) could be useful for those facing this case i believe
8. code-asher commented on Oct 24, 2022

   

   code-asher

   on Oct 24, 2022 via email

   Last edited by code-asher

   Member

   More actions

   Yeah this will affect any extension that uses web views since Code uses iframes and service workers for web views. I think web views have always used service workers in which case there is no version of code-server that will work but someone will have to test older versions to see if that is true. Maybe there is an old version that did not use service workers. To summarize the remaining fixes: 1. Use a certificate signed by an authority (Let's Encrypt, etc). 2. Add the certificate to the system certificate store. 3. Add the certificate to the browser certificate store. 4. Use a browser that does not have the same restrictions. 5. Roll back to an older browser version. 6. Bypass certificate errors with a flag to the browser.
9. neurorepro commented on Oct 24, 2022

   

   neurorepro

   on Oct 24, 2022

   More actions

   So what would be the steps to do for a server once it is configured with Let's Encrypt? Just set yes to use cert in code server configuration file ? Anything else ?
10. code-asher commented on Oct 24, 2022

    

    code-asher

    on Oct 24, 2022 via email

    Last edited by code-asher

    Member

    More actions

    There are two main options for using a Let's Encrypt certificate: 1. Use a reverse proxy like NGINX or Caddy to handle the certificate. Here are guides for setting that up and automating certificate renewal: https://github.com/coder/code-server/blob/main/docs/guide.md#using-lets-encrypt-with-caddy https://github.com/coder/code-server/blob/main/docs/guide.md#using-lets-encrypt-with-nginx If you are using a reverse proxy set `cert` to false in code-server (or remove the flag). 2. To have code-server directly handle the cert set code-server's `cert` flag to the path of the Let's Encrypt cert and `cert-key` to the key for the certificate. The code-server invocation should look something like this: ``` code-server --cert /path/to/cert.crt --cert-key /path/to/key.pem ```
11. jneuhauser commented on Oct 25, 2022

    

    jneuhauser

    on Oct 25, 2022

    Last edited by jneuhauser

    Author

    More actions

    Thanks for your inputs.

    So to use code-server with working service workers we need a trusted certificate?
    Is it possible to get service workers working with http on chrome?
12. code-asher commented on Oct 27, 2022

    

    code-asher

    on Oct 27, 2022 via email

    Member

    More actions

    Yup, that is correct. Browsers will only allow service workers in "secure contexts" which includes localhost and https. https://www.w3.org/TR/service-workers/#secure-context https://html.spec.whatwg.org/multipage/webappapis.html#secure-context Since it includes localhost one way around having to generate a valid certificate is to use SSH forwarding if that is available to you. https://github.com/coder/code-server/blob/ba44f6cc979de60c6de180dc2f4ee8e0a206d43e/docs/guide.md#port-forwarding-via-ssh I think you can force service workers to run on http by setting `chrome://flags/#unsafely-treat-insecure-origin-as-secure` but I have not tried this. https://stackoverflow.com/questions/40696280/unsafely-treat-insecure-origin-as-secure-flag-is-not-working-on-chrome/53388534#53388534
13. jneuhauser commented on Oct 28, 2022

    

    jneuhauser

    on Oct 28, 2022

    Author

    More actions

    Thank you very much...
    I've defined http://192.168.107.129:8080 as secure origin in chrome://flags/#unsafely-treat-insecure-origin-as-secure and it works. :-)
    Using the auto generated self signed cert (cert: true) and defining https://192.168.107.129:8080 (https Instead of http) does not work.

    So to sum up what makes service workers work is:

    • Using code-server with a trusted certificate
      • Use Let's Enrcrypt in combination with:
        • A reverse rroxy
          https://github.com/coder/code-server/blob/main/docs/guide.md#using-lets-encrypt-with-nginx
          https://github.com/coder/code-server/blob/main/docs/guide.md#using-lets-encrypt-with-caddy
          Web socket fails to connect through Apache #4723 (comment)
        • Direct with code-server --cert /path/to/cert.crt --cert-key /path/to/key.pem
      • Use https://mkcert.dev/ for trusted self signed certs
    • Using code-server over localhost / 127.0.0.1
      • Run code-server on the same host or as Docker container and connect over localhost / 127.0.0.1
      • Use SSH forwarding to make a remote code-server available over localhost / 127.0.0.1
        https://github.com/coder/code-server/blob/main/docs/guide.md#port-forwarding-via-ssh
    • Define your HTTP-URL (example: http://192.168.107.129:8080) as secure origin. HTTPS-URLs may not work!
      • Chrome Browser: chrome://flags/#unsafely-treat-insecure-origin-as-secure
      • Firefox Browser: ???
      • ...

    Can/Should we close this issue or should i leave it open till anyone updates the documentation?

    👍React with 👍8Reacted by Joe Previte, Rubén, madcpt, Anh Quan Nguyen , j.b.huang, fiveight58, TomIsFat and Yuan Ren
14. code-asher

    changed the title [-][Bug]: Markdown preview not working with self signed certificate (SecurityError)[/-] [+]Extensions using web views not working with self signed certificate[/+] on May 22, 2024
15. code-asher

    closed this as completedin 6a14070on Jul 11, 2024
16. bikramtuladhar

    added a commit that references this issue on Jul 11, 2024

    Add faq entry about web views

    ...

    This issue will close once commit 6a14070 is merged into the 'main' branch.

    6a14070
17. yiliang114

    added a commit that references this issue on Jan 23, 2025

    Add faq entry about web views

    ...

    This issue will close once commit 96931f8 is merged into the 'main' branch.

    96931f8