-
Notifications
You must be signed in to change notification settings - Fork 13
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix https and add wss support #201
Fix https and add wss support #201
Conversation
did you test it? |
Making this work properly depends on some very specific behavior from the server, that is: If the request is http, but contains a wss: in the connect argument, redirect to https (this might not even necessary because browsers love bumping the request to https regardless, but should be added for completeness) Especially the second case is hard/impossible from the browser point of view (js shouldn't be able to downgrade to http for security reasons). I don't see how this can be solved without additional configuration on the server side. The current implementation with two different subdomains is very stupid. I have a better idea for this implementation, so just hang on. Here's what the nginx config for the required behavior looks like:
I am using 302 because I'm not 100% certain how different browsers may cache 301 redirects based on the combination of protocol, domain, port and query arguments. That makes it a bit safer. So note that this change will require more testing and infrastructure changes before merging. |
I have successfully tested this nginx config on https://webao.troid.tech Again, this is required on the server side in order for this to be consistent and functional on all browsers |
also known as "whoops, we actually needed that code" This changes "Online" to "Players", and will only show the playercount reported by masterserver. It's a bit disingenuous to show "Online" if we can't confirm that we can actually connect to it.
can you please add the target="_blank" from the troid.tech version |
The target=_blank in join and watch buttons should be present in the latest version. |
This changes the way the serverlist works quite fundamentally. Notable points:
The benefits is that the server list is more respectful of the user's privacy (no connection/giving away your IP on hovering) and it works with https (no more annoying warnings).
The drawbacks is that it requires configuring an "insecure" domain and that the client can't know if the server is reachable from the serverlist.
A proof of concept is live at https://web.troid.tech/ , it might require additional testing.