ipfs/ipfs-companion

Disabling on specific host should reload page from HTTPS

Open

#864 opened on Apr 9, 2020

View on GitHub
 (0 comments) (0 reactions) (0 assignees)JavaScript (364 forks)batch import
P2effort/hoursexp/beginnergood first issuehelp wantedkind/bugstatus/readytopic/security

Repository metrics

Stars
 (1,992 stars)
PR merge metrics
 (Avg merge 53d 3h) (1 merged PR in 30d)

Description

Filling from mobile so we don't forget. Good first issue if someone wants to fix this via a PR before I get to it next week.

Right now, when IPFS integrations are disabled via a toggle, extension assumes http://.

Most servers redirect http:// → https://, or have HSTS set up, but Companion should default to https://, because if someone did not set up redirect to a secure context, there is a risk of the same website being loaded from http.

Easy fix is to use https:// in the line below:

https://github.com/ipfs-shipyard/ipfs-companion/blob/06227a244d357e2969b52f01dda8ee13df286446/add-on/src/popup/browser-action/store.js#L196

Contributor guide

Research direction
Change the URL protocol from http to https in the specified line in store.js to default to HTTPS when IPFS integrations are disabled.
Tech stack
javascript
Domain
backend
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
1
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Under 1 hour
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
Git
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
90