Can an HTTPS web application make calls to a non-HTTPS origin?

user_586030 0
Viewed 222

I have a small web application that needs to make calls to a device on my local network. It does this using fetch to the local IP address of the device (e.g. http://192.168.1.25:8060). The device does not serve its traffic over HTTPS and cannot. The web application is public facing and I would like to add a service worker for offline support.

Service workers require HTTPS, and calls from an HTTPS origin to a non-HTTPS origin are a security risk and so are not allowed by modern browsers. Without using a local proxy (which would defeat the purpose), is there some way around this "limitation"?

How can "https://example.com" make a call to http://192.168.1.25:8060?

service-worker https javascript
1 Answers

Possible duplicate of How can I allow Mixed contents (http with https) using content-security-policy meta tag?. Browsers won't allow this because it breaks the user trust model.

A local HTTPS proxy is ideal. Configure a public DNS entry like internal.example.com with a low TTL (if your internal IP changes often) to point to your internal IP. Create a trusted SSL cert for that subdomain, then run your local HTTPS proxy with that SSL cert. If your internal server is behind a firewall, point internal.example.com to a public web server first, create the cert on that public server, than copy the cert and change the DNS to your local server. Or use a wildcard cert *.example.com to avoid that "temporary public" hassle entirely.

user_40358450
Related