Timeline for HTTPS site perform ajax calls to native http desktop aplication
Current License: CC BY-SA 4.0
9 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 9, 2019 at 20:36 | comment | added | albciff | Thanks for the update, at first time I read the answer and I understand the model which I implement :). however I already saw that put a private (issued by a trusted ca) in a application is not a.good idea. I implement a diferent approach, for each installation we generate a fake ca, and issue a server certificate for this ca to protect nativa.aoclocal.cat (which domain resolves to 127.0.0.1) then the installation proces automatically install this ca in windows truststore. It's maybe not the best solution but this way each installation has a different ca and stole one only compromise this pc. | |
| Feb 8, 2019 at 16:50 | comment | added | Mathieu Fortin | @albciff see updated answer. If someone tells your CA that you embed the private key locally it will get revoked (i think they have 24 hours to do so). Pretty hard denial of service... | |
| Jan 31, 2019 at 16:57 | history | edited | Mathieu Fortin | CC BY-SA 4.0 |
added 982 characters in body
|
| Nov 28, 2016 at 7:28 | vote | accept | albciff | ||
| Nov 28, 2016 at 7:28 | comment | added | albciff | I review this and make some tries, and it works correctly, and for the user perspective the functionality is clean and doesn't require an action for their part, the problem is that I must embed a valid private key for server certificate in the native application, this action implies that my key could be stolen so I've to think about the risk of this. Anywise thanks for the answer :). | |
| Nov 25, 2016 at 17:27 | comment | added | albciff |
wow! I read the spotify article a bit... I'll take a more deep look on it later... but ping to any domain in *.spotilocal.com resolving to 127.0.0.1 looks promising. Thanks :) +1!
|
|
| Nov 25, 2016 at 16:42 | history | edited | Mathieu Fortin | CC BY-SA 3.0 |
added 698 characters in body
|
| Nov 25, 2016 at 16:35 | history | edited | Mathieu Fortin | CC BY-SA 3.0 |
added 698 characters in body
|
| Nov 25, 2016 at 16:26 | history | answered | Mathieu Fortin | CC BY-SA 3.0 |