dotjs loads scripts insecurely, "breaking" SSL on every site about dotjs HOT 11 CLOSED

This error started to pop up when I updated Chrome. Guess Chrome have changed something in the security policy.

from dotjs.

👍

Could this be fixed by changing "http://" to just "//" here? https://github.com/defunkt/dotjs/blob/master/ext/dotjs.js#L2

from dotjs.

Can't test it right now, but that sounds right.

from dotjs.

Ok, there seems to be a new security policy in Chrome 22. In the extension documentation it is stated that you can allow loading scripts with content_security_policy from http://localhost but that does not work. The fix for the error will be released in Chrome 23. And // doesn't work since the dotjs webserver does not serve https. I was a little to fast when I tested it.

from dotjs.

If the dotjs webserver doesn't serve https, maybe something like https://github.com/jugyo/tunnels could be used to proxy from https to it. I came across that gem in the context of having https for pow, but could apply here too.

from dotjs.

Confirmed that tunnels works. Kind of annoying though.

from dotjs.

💡 piggyback on github's ssl by hacking the extension to point to https://raw.github.com/foo/bar/master/ instead of http://localhost:3131/.

from dotjs.

@zeke You mean commit your .js/ and put it on GitHub? That would work, but it sounds like a pain.

Is there an easy way to spin up an nginx that tunnels? That would avoid the ugliness of RubyGems, and seems like a reasonable dependency.

from dotjs.

Got this working with just WEBrick. You'll need to uninstall dotjs then install 2.0 to get the new stuff.

from dotjs.

Thanks! 🍻

from dotjs.

To uninstall: rake uninstall

from dotjs.