{"record":{"id":"169dd772269854b3","repo":"amark/gun","slug":"https-needed-for-webcrypto-in-sea-redirecting","errorCode":null,"errorMessage":"HTTPS needed for WebCrypto in SEA, redirecting...","messagePattern":"HTTPS needed for WebCrypto in SEA, redirecting\\.\\.\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"sea/https.js","lineNumber":11,"sourceCode":";(function(){\n\n    var SEA = require('./root');\n    try{ if(SEA.window){\n      if(location.protocol.indexOf('s') < 0\n      && location.host.indexOf('localhost') < 0\n      && ! /^127\\.\\d+\\.\\d+\\.\\d+$/.test(location.hostname)\n      && location.protocol.indexOf('blob:') < 0\n      && location.protocol.indexOf('file:') < 0\n      && location.origin != 'null'){\n        console.warn('HTTPS needed for WebCrypto in SEA, redirecting...');\n        location.protocol = 'https:'; // WebCrypto does NOT work without HTTPS!\n      }\n    } }catch(e){}\n  \n}());","sourceCodeStart":1,"sourceCodeEnd":16,"githubUrl":"https://github.com/amark/gun/blob/552227599d47ba0493824b7fcf8a00c8cd6404ba/sea/https.js#L1-L16","documentation":"SEA relies on the browser WebCrypto API for its cryptographic operations, and browsers only expose secure WebCrypto (crypto.subtle) on HTTPS (or special safe contexts). In sea/https.js, if the page is served over plain HTTP from a non-localhost, non-127.x, non-blob:, non-file: origin, SEA warns and forcibly rewrites location.protocol to 'https:', causing a page navigation/redirect.","triggerScenarios":"Loading a Gun/SEA app via http:// on a LAN IP, a domain name, or any hostname that is not localhost / 127.x.x.x, and not inside a blob: or file: URL. The check runs at SEA module load; the condition `location.protocol.indexOf('s') < 0` (http) plus a non-safe host triggers the warning and `location.protocol = 'https:'`.","commonSituations":"Testing SEA on a phone or another machine via http://192.168.x.x during development; deploying behind a proxy that terminates TLS but serves the page over http; forgetting to enable HTTPS on a production Gun app; self-signed cert not trusted so the automatic https redirect fails to load.","solutions":["Serve the app over HTTPS (install a valid certificate or use a TLS-terminating reverse proxy).","For local development use http://localhost or http://127.0.0.1, which are exempt from the check.","For quick local tests without a server, open the page via file:// or serve via blob: URLs, which are also exempt.","If HTTPS is genuinely impossible, wrap/include SEA so the https.js check is bypassed or stub location.protocol — note WebCrypto may still be unavailable and SEA will fail later.","Set up a trusted dev certificate (e.g. mkcert) and access via https://localhost instead of an IP."],"exampleFix":"// before\\nhttp://192.168.1.5:8080  // triggers redirect\\n// after\\nhttps://192.168.1.5:8443 // or use http://localhost:8080 for dev","handlingStrategy":"validation","validationCode":"const loc = window.location;\\nconst isSecure = loc.protocol === 'https:';\\nconst isLocal = loc.hostname === 'localhost' || /^127\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+$/.test(loc.hostname);\\nconst isSpecial = /^(blob:|file:)/.test(loc.protocol) || loc.origin === 'null';\\nif (!isSecure && !isLocal && !isSpecial) {\\n  console.warn('SEA requires HTTPS outside localhost — serve over https or use localhost');\\n}\\nif (!(window.crypto && window.crypto.subtle)) {\\n  console.error('WebCrypto (crypto.subtle) unavailable — SEA cannot run');\\n}","typeGuard":"function hasWebCrypto(w){ return typeof w !== 'undefined' && !!(w.crypto && w.crypto.subtle && typeof w.crypto.subtle.encrypt === 'function'); }","tryCatchPattern":"try {\\n  if (!(window.crypto && window.crypto.subtle)) throw new Error('WebCrypto requires a secure context (HTTPS)');\\n  // ... initialize SEA / Gun here\\n} catch (e) {\\n  console.error('SEA init failed:', e.message); // show a user-facing 'use HTTPS' notice\\n}","preventionTips":["Deploy behind HTTPS from day one (Let's Encrypt / TLS-terminating proxy).","Test on real devices via localhost tunnels (e.g. ngrok) which provide https, not raw http://LAN-IP.","Check for crypto.subtle before initializing SEA to fail fast with a clear message.","Remember WebCrypto is only available in secure contexts: https, localhost/127.x, file:, blob:."],"tags":["browser","https","webcrypto","security","redirect"],"backgroundTag":"insecure-context-webcrypto","analyzedSha":"552227599d47ba0493824b7fcf8a00c8cd6404ba","analyzedAt":"2026-09-02T18:40:58.370Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T21:17:11.164Z"}