1

I built an app, which authenticates users via oauth2. I have a simple server that can accept requests.

After authentication, the user is redirected to https://127.0.0.1:1234/token=<token> and the app listens on this port.

How can I make a certificate to accept a callback from the host? Self-signed certificates are restricted on many browsers.

Let's Encrypt and many other certificates are for domains, not local hosts.

Improve this question
5
  • Self-signed certificates are not restricted on many browsers. They just show a warning.
    – schroeder ♦
    Commented Mar 19, 2021 at 13:01
  • If you do not want a self-signed certificate then you need a certificate authority in the local network. This is a lot of work. A self-signed certificate really is the way to go.
    – schroeder ♦
    Commented Mar 19, 2021 at 13:03
  • It can self signed, its not important, but as i say "The page you are trying to view cannot be shown because the authenticity of the received data could not be verified", maybe thats not is certificate problem.
    – Alice Thornberry
    Commented Mar 19, 2021 at 13:55
  • This is a warning about the certificate, yes. But you can still go to the page and it will be encrypted.
    – schroeder ♦
    Commented Mar 19, 2021 at 14:50
  • Weirdly near identical to stackoverflow.com/questions/66705354/… just hours earlier which I referred to stackoverflow.com/questions/6793174/…
    – dave_thompson_085
    Commented Mar 20, 2021 at 0:43

1 Answer 1

Reset to default
2

Why do you want to run https to localhost anyway? There's no point in it.

TLS is meant to guarantee confidentiality, integrity, and authenticity of the connection against an attacker living on the network path between you and the server, but if you're connecting to localhost, there IS nothing between you and the server.

CA's won't issue a certificate to localhost, a certificate embedded in your desktop app can be easily reverse engineered and stolen, and a self-signed certificate is as good for security as none at all.

Just use plain http to localhost.

If you're worried that browsers will spook at you for "mixed content" or something, don't worry—modern browsers (at least I'm pretty sure Firefox does) treat localhost as secure regardless of how you connect to it.

Improve this answer
2
  • When oauth is finished, its redirect to https://localhost with token. Host restrict to create callback with http scheme, only https. I dont care about notify, that sertificate self signed etc., but browser say me "The page you are trying to view cannot be shown because the authenticity of the received data could not be verified."
    – Alice Thornberry
    Commented Mar 19, 2021 at 13:48
  • @AliceThornberry you don't have any control over the redirect uri scheme?
    – multithr3at3d
    Commented Mar 21, 2021 at 13:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .