amark/gun · warning

HTTPS needed for WebCrypto in SEA, redirecting...

Error message

HTTPS needed for WebCrypto in SEA, redirecting...

What it means

SEA relies on the browser WebCrypto API for its cryptographic operations, and browsers only expose secure WebCrypto (crypto.subtle) on HTTPS (or special safe contexts). In sea/https.js, if the page is served over plain HTTP from a non-localhost, non-127.x, non-blob:, non-file: origin, SEA warns and forcibly rewrites location.protocol to 'https:', causing a page navigation/redirect.

Source

Thrown at sea/https.js:11

;(function(){

    var SEA = require('./root');
    try{ if(SEA.window){
      if(location.protocol.indexOf('s') < 0
      && location.host.indexOf('localhost') < 0
      && ! /^127\.\d+\.\d+\.\d+$/.test(location.hostname)
      && location.protocol.indexOf('blob:') < 0
      && location.protocol.indexOf('file:') < 0
      && location.origin != 'null'){
        console.warn('HTTPS needed for WebCrypto in SEA, redirecting...');
        location.protocol = 'https:'; // WebCrypto does NOT work without HTTPS!
      }
    } }catch(e){}
  
}());

View on GitHub (pinned to 552227599d)

Solutions

1. Serve the app over HTTPS (install a valid certificate or use a TLS-terminating reverse proxy).
2. For local development use http://localhost or http://127.0.0.1, which are exempt from the check.
3. For quick local tests without a server, open the page via file:// or serve via blob: URLs, which are also exempt.
4. If HTTPS is genuinely impossible, wrap/include SEA so the https.js check is bypassed or stub location.protocol — note WebCrypto may still be unavailable and SEA will fail later.
5. Set up a trusted dev certificate (e.g. mkcert) and access via https://localhost instead of an IP.

Example fix

// before\nhttp://192.168.1.5:8080  // triggers redirect\n// after\nhttps://192.168.1.5:8443 // or use http://localhost:8080 for dev

const loc = window.location;\nconst isSecure = loc.protocol === 'https:';\nconst isLocal = loc.hostname === 'localhost' || /^127\\.\\d+\\.\\d+\\.\\d+$/.test(loc.hostname);\nconst isSpecial = /^(blob:|file:)/.test(loc.protocol) || loc.origin === 'null';\nif (!isSecure && !isLocal && !isSpecial) {\n  console.warn('SEA requires HTTPS outside localhost — serve over https or use localhost');\n}\nif (!(window.crypto && window.crypto.subtle)) {\n  console.error('WebCrypto (crypto.subtle) unavailable — SEA cannot run');\n}

function hasWebCrypto(w){ return typeof w !== 'undefined' && !!(w.crypto && w.crypto.subtle && typeof w.crypto.subtle.encrypt === 'function'); }

try {\n  if (!(window.crypto && window.crypto.subtle)) throw new Error('WebCrypto requires a secure context (HTTPS)');\n  // ... initialize SEA / Gun here\n} catch (e) {\n  console.error('SEA init failed:', e.message); // show a user-facing 'use HTTPS' notice\n}

When it happens

Trigger: Loading a Gun/SEA app via http:// on a LAN IP, a domain name, or any hostname that is not localhost / 127.x.x.x, and not inside a blob: or file: URL. The check runs at SEA module load; the condition `location.protocol.indexOf('s') < 0` (http) plus a non-safe host triggers the warning and `location.protocol = 'https:'`.

Common situations: Testing SEA on a phone or another machine via http://192.168.x.x during development; deploying behind a proxy that terminates TLS but serves the page over http; forgetting to enable HTTPS on a production Gun app; self-signed cert not trusted so the automatic https redirect fails to load.

AI-assisted analysis of amark/gun@552227599d (2026-09-02). Data as JSON: /api/errors/169dd772269854b3. Report an issue: GitHub.