{"record":{"id":"e632a531b01b600f","repo":"RocketChat/Rocket.Chat","slug":"e2e-encryption-can-only-be-enabled-in-secure-conte","errorCode":null,"errorMessage":"E2E encryption can only be enabled in secure contexts (HTTPS)","messagePattern":"E2E encryption can only be enabled in secure contexts \\(HTTPS\\)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/client/lib/e2ee/rocketchat.e2e.ts","lineNumber":347,"sourceCode":"\t\t\t\tonClose: imperativeModal.close,\n\t\t\t\tonCancel: () => {\n\t\t\t\t\tthis.closeAlert();\n\t\t\t\t\timperativeModal.close();\n\t\t\t\t},\n\t\t\t\tonConfirm: () => {\n\t\t\t\t\tremoveStoredItem(STORAGE_KEYS.E2EE_RANDOM_PASSWORD);\n\t\t\t\t\tthis.setState('READY');\n\t\t\t\t\tdispatchToastMessage({ type: 'success', message: t('E2E_encryption_enabled') });\n\t\t\t\t\tthis.closeAlert();\n\t\t\t\t\timperativeModal.close();\n\t\t\t\t},\n\t\t\t},\n\t\t});\n\t}\n\n\tasync startClient(userId: string): Promise<void> {\n\t\tif (!isSecureContext) {\n\t\t\tthrow new Error('E2E encryption can only be enabled in secure contexts (HTTPS)');\n\t\t}\n\n\t\tconst span = log.span('startClient');\n\t\tif (this.userId === userId) {\n\t\t\treturn;\n\t\t}\n\n\t\tspan.info(this.state);\n\n\t\tthis.userId = userId;\n\t\tthis.keychain = new Keychain(userId);\n\n\t\tlet { public_key, private_key } = this.getKeysFromLocalStorage();\n\n\t\tawait this.loadKeysFromDB();\n\n\t\tif (!public_key && this.db_public_key) {\n\t\t\tpublic_key = this.db_public_key;","sourceCodeStart":329,"sourceCodeEnd":365,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/f9d3ec372bb580fa8d036f94cf03925a478ef768/apps/meteor/client/lib/e2ee/rocketchat.e2e.ts#L329-L365","documentation":"Thrown by the E2E (end-to-end encryption) client's startClient method when the browser's isSecureContext flag is false. isSecureContext is a Web API that is true only when the page is served over HTTPS (or is localhost/127.0.0.1). E2E encryption relies on the Web Crypto API (specifically crypto.subtle), which is only available in secure contexts, so the client refuses to initialize without it.","triggerScenarios":"The Rocket.Chat web client is served over plain HTTP (not HTTPS) and the hostname is not localhost. The app is loaded in an insecure iframe. A proxy or load balancer terminates TLS but the app origin is misconfigured as http://. Service worker or non-secure origin context.","commonSituations":"Self-hosted development/staging server without TLS configured. Behind a reverse proxy where X-Forwarded-Proto is not set correctly, so the Node server thinks it is HTTP. Using an IP address instead of localhost over plain HTTP. Migration from HTTP to HTTPS that left the ROOT_URL as http://.","solutions":["Serve the Rocket.Chat client over HTTPS (configure TLS on the server or use a TLS-terminating reverse proxy).","For local development, use http://localhost or http://127.0.0.1 — these are treated as secure contexts by browsers.","If behind a reverse proxy (nginx, Traefik), ensure X-Forwarded-Proto: https is passed and ROOT_URL is set to https://.","Disable E2E if HTTPS is not available and encryption is not required for the deployment."],"exampleFix":"// before: served over http://chat.example.com\n// after: configure TLS\n// nginx config:\n// listen 443 ssl;\n// proxy_set_header X-Forwarded-Proto https;\n// ROOT_URL=https://chat.example.com","handlingStrategy":"validation","validationCode":"if (!window.isSecureContext) {\n  // show user-facing error: HTTPS required for E2E\n  showE2ESecureContextError();\n  return;\n}\nawait e2e.startClient(userId);","typeGuard":"const isSecureContextAvailable = (): boolean => typeof window !== 'undefined' && window.isSecureContext === true;","tryCatchPattern":"try {\n  await e2e.startClient(userId);\n} catch (e) {\n  if (e instanceof Error && e.message.includes('secure context')) {\n    dispatchToastMessage({ type: 'error', message: t('E2E_requires_https') });\n    return;\n  }\n  throw e;\n}","preventionTips":["Always serve Rocket.Chat over HTTPS in production.","For local development, use localhost (treated as a secure context).","Set ROOT_URL to https:// and ensure reverse proxy passes X-Forwarded-Proto.","Check window.isSecureContext before initialising E2E features."],"tags":["e2ee","security","https","crypto","browser-api","configuration"],"backgroundTag":null,"analyzedSha":"f9d3ec372bb580fa8d036f94cf03925a478ef768","analyzedAt":"2026-08-12T19:07:17.372Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}