1

I'm currently developing a Website that requires direct access to the client computer. Therefore I decided to split this project in this three main parts.

enter image description here

There are some requirements that have to apply

  • The Website has to use SSL everywhere because sensitive user data is exchanged with the API
  • The connection between the website and the client application has to be over localhost because a lot of data is exchanged that shouldn't be handled by an external server

Currently I'm using websockets to provide the connection between the website and the client application. This results in the problem that the websocket connection has to be SSL secured too because an unsecured connection is rejected.

Therefore I'm installing a self signed localhost cert on the client machine to be able to connect between the website and the client application. This is really dirty and not a preferable solution. Now I'm searching for a new solution for this problem.

Sadly I cannot start a websocket server out of angular. This would resolve the problem with the certificate. I'm curious how Battlelog is doing this. According to this answer the plugin is using windows named pipe. This sounds interesting but I'm unsure whether I could use them in this scenario.

Is there a possibility to solve this problem?

Improve this question
6
  • 4
    Why not dump the web site & just have your client app talk directly to your back end API?
    – Dan Pichelman
    Commented Sep 26, 2017 at 15:06
  • The client app should be used as a connector between pc and website. It's easier to maintain Angular and Frontend is taking a lot of time in .NET
    – Christian Klemm
    Commented Sep 26, 2017 at 19:20
  • Is it possible for you to use Node on the client? Then, you could access stuff from the OS within the web site. This would dump the client app and solve the self-signed cert problem.
    – Emerson Cardoso
    Commented Sep 27, 2017 at 11:47
  • @EmersonCardoso Is it possible to run Node on the client? I'm unable to find any information regarding this. AFAIK Node is a server side javascript implementation and Angular is client side.
    – Christian Klemm
    Commented Sep 27, 2017 at 12:36
  • You could use the client machine as 'server' of pages with Angular. The client machine could load any information and then serve the pages, according to localhost requests. The node app would also make secured requests to the actual backend in PHP when necessary. Another approach you could use is to implement a desktop app using Web technologies (qt with webengine, Node also supports this), in order to keep the Angular (since you find it easier to maintain)
    – Emerson Cardoso
    Commented Sep 27, 2017 at 13:27

2 Answers 2

Reset to default
1

Finally I've found a solution.

Strangely it is possible to route a subdomain to 127.0.0.1 Getting a trusted cert for this subdomain is possible and therefore the connection is trusted.

Improve this answer
0

Odds are, Battlelog is still using a certificate. It's just signed by a third party certificate authority, instead of self signed. The best solution is probably to get your Certificate signed by a trusted Certificate Authority.

Your client application has to be sure that it's connected to the right server, instead of an impostor. In order to do that, you'll probably just need to have a certificate, even if it's self signed.

I'm not positive, but since you're the one making the client side application, you might be able to bundle the your certificate's hash with your application, and check that against the server when you run it.

Improve this answer
6
  • Yeah, I'm aware of this problem and there is already such a verification. I'm asking for a solution that is not based on websockets or a possibility to use websockets locally without installing a self signed localhost cert.
    – Christian Klemm
    Commented Sep 27, 2017 at 12:39
  • I see. I guess I'll delete this answer.
    – Christopher Waugh
    Commented Sep 27, 2017 at 12:45
  • Hang on, your question says you have to use SSL everywhere. That means you have to have a Certificate no matter what you use. So the only possible solution must be to get your certificate signed by a third party Certificate Authority.
    – Christopher Waugh
    Commented Sep 27, 2017 at 12:49
  • When the browser is acting as the server it could just allow any certificate it gets. SSL between browser and client is not used to verify or protect the information that is exchanged, it is needed because a websocket on a website that is using SSL has to run over SSL too. Which authority would sign a localhost certificate?
    – Christian Klemm
    Commented Sep 27, 2017 at 13:37
  • I figured the client was connecting to the server that was hosting the angular webpage. Are you saying that the client application is connecting to an open browser window? This is a horse of a different color than I thought the horse was...
    – Christopher Waugh
    Commented Sep 27, 2017 at 15:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.