Background: I have a web app that is accessed via Chrome on a Windows 10 machine.
I also have a native Win10 application installed on the device. The web app sends data to the Win10 application via a local web service running on the machine in IISExpress.
To allow for HTTPS communication on port 44300, I've created a self-signed certificate via PowerShell:
New-SelfSignedCertificate -DnsName "localhost" -CertStoreLocation "cert:\LocalMachine\My" -NotAfter (Get-Date).AddMonths(60)
And then imported it to 'Local Computer\Trusted Root Certificates\Certificates'
From within the web app I send a command to the win10 app that looks something like this:
https://localhost:44300/CMTService.svc/JumpToAssignment?Param=Key=418584577
The win10 app is polling for these requests and picks up the message.
Issue:
Different versions of Chrome behave differently with the acceptance of the self-signed certificate. For instance versions 62, 64 and 75 all accept the certificate and allow for communication with the web service. But other versions of Chrome like 76 and 78 block communication. The Security tab in the Chrome DevTools shows https://localhost:44300 as "Unknown / cancelled" and my requests fail with ERR_SSL_CLIENT_AUTH_CERT_NEEDED. Whereas in working versions of Chrome my URL shows under "Secure origins". The only thing that I change is the Chrome version to get these different results.
I've tried enabling the Chrome setting to allow for invalid certs for localhost (chrome://flags/#allow-insecure-localhost). This temporarily works, but then after closing and reopening chrome, my requests start failing again with the same error code.
If I take one of my failing URLs and paste it into a new Chrome tab, suddenly communication with my native app in my web app resumes as normal. But it only works for that session - when I close and reopen Chrome my communication is broken again.
Question:
How do I allow for communication between my Chrome v78 web app and my local native app?
ERR_SSL_CLIENT_AUTH_CERT_NEEDED means the server is asking the browser for a certificate for client authentication.
You've described how you setup server authentication, but not described how you setup client authentication.
Likely you have enabled certificates for client authentication, but have not configured the web app to send the correct client certificate or have not configured the native app to accept the correct client certificate. That's a very open ended topic to be prescriptive without knowing more about your development efforts, but you can confirm if client authentication is enabled by inspecting a packet capture. One description of the handshake is here : https://blogs.technet.microsoft.com/nettracer/2013/12/30/how-it-works-on-the-wire-iis-http-client-certificate-authentication/.
Just an update: I implemented a javascript workaround to get around my communication issues. When first loading the web app, I simply send my first communication to IIS (destined for Win10 native app) in a separate chrome browser tab. For whatever reason this allows for successful acceptance of the certificate and kick starts the communication with IIS. This is my code to send the command in a new tab and then close it:
var inst = window.open(launchWinAppURL);
if (inst != null) {
window.setTimeout(function() {
inst.close();
}, 1000);
}
This is not the most elegant solution, but it seems to work on all chrome versions, so i'm satisfied.
Is the web app only communicating with the one win10 machine? Have you installed the self-signed cert directly to the machine? I would try installing it directly to the machine and see if the later instances of chrome allow communication.
Related
In my particular network environment the Google chrome executable can access via an authenticated outgoing proxy server external web sites. Other executables however (when pointing to that outgoing proxy) are not able to do so.
I now have the idea to use Chrome itself as a local proxy for other executables like git or pip. - Is this possible, say, with a Chrome extension or with a tool that uses Chrome in a headless mode to connect to the Internet?
To clarify, I am not asking how to configure the proxy settings inside Chrome - I have successfully done this. I am asking how I can set up Chrome to receive HTTP(S) requests from other local programs and pass the requests on as an intermediate proxy (to the outgoing proxy specified in Chrome's settings).
On its own, no: Chrome will not open a port that other software can connect to. Even WebRTC requires an intermediate server to begin a peer to peer connection between browsers.
However Chrome supports Native Messaging, which means it will execute a specific native application that already exists on the system.
With this set up you can have:
a native application that accepts incoming connections and forwards data to the extension.
the extension listens to messages from the application and sends them via Chrome elsewhere on the internet.
Using: Chrome 67.0.3396.99
Our webserver implements X.509 client authentication. The certificates are offered through the PKCS#11 interface; we connect a smartcard (in this case: Yubikey 4), the browser prompts for the certificate selection and PIN.
We disconnected the smartcard and visited the authenticated domain (say, localhost:8000) to observe the behavior of the webserver (in a local development environment).
The webserver correctly refused to serve the request.
However, Chrome now does never send anymore the certificates while visiting localhost:8000, even if the smartcard is connected.
The following did not resolve the problem:
Clearing all site data through the developer console;
Resettting site preferences to their defaults (through chrome://settings/content/siteDetails?);
Rebuilding the webserver.
Any pointer where I can clear this state from Chrome would be greatly appreciated. As a temporary fix, we run the server at a different port but this is not an option on the long term. As this scenario is very plausible to also happen in production.
I am hosting my page inside the sdcard of arduino, I have implemented web speech api feature in that, however when I test my site using 127.0.0.1/project-X , everything works perfect, but when I use 192.168.1.4(which is same machine) or 192.168.1.10 (which is other laptop having WAMP) Chrome does not allow the microphone? I have also tried to start Chrome using different flags found on Google but none of them worked. What to do? I just want Chrome to allow using microphone from local ip also!
Chrome now allows Microphone access over secured Http only. You can very easily create your own signed SSL certificate and use that to host your page via Https.In tomcat server.xml you just have to un-comment the ssl connector and point to the location of your certificate.
A Chrome Packaged Application under Windows 10 doesn't seem to be using my public proxy settings under Internet Options. I'm trying to monitor this application's network activity via Fiddler installed on another computer. Every HTTP and HTTPS requests are successfully monitored there, except the ones from this packaged application.
I'm pretty sure it uses HTTP requests behind, because I generated it from an Android APK file, using ARC Welder. And I can see HTTP requests from Android application itself on my phone. But not from generated packaged chrome application on Windows. Is there anything I can do with the manifest file or something else?
Thank you.
chrome.sockets API does not use the Chrome browser proxy settings.
On ChromeOS, chrome.sockets will respect the system-wide VPN settings, however.
What I'm trying should be basic; but must be missing something. Have couple of SignalR Hubs defined inside an MVC3 app running locally. Same solution has a Windows Phone 8 & a Windows Store app, both talking to the SignalR hubs for real-time communication. SignalR server uses latest bits & clients use latest .NET nuget.
On the client side, this is what I'm used to writing:
IHubProxy SignalRChatHub;
HubConnection chatConnection = new HubConnection("http://localhost:53478/");
SignalRChatHub = chatConnection.CreateHubProxy("ChatHub");
await chatConnection.Start();
if (chatConnection.State == Microsoft.AspNet.SignalR.Client.ConnectionState.Connected)
{
// Stuff here.
}
This works perfectly fine with a Windows 8 app client & we have easy connectivity with the SignalR hub running locally on IIS. However, the same code does not work for a Windows Phone client. The connection.start() bombs out with a 404 exception.
After a little research, it looks like the WP Emulator VM is treated as a different machine and uses the host machine's network virtually. So, IIS may be blocking calls from outside not allowing reach into the SignalR hub from Windows Phone 8 app. Accordingly, I tweak applicationhost.config for the SignalR server app to allow connectivity from outside localhost. So now, the SignalR hub is functional from both localhost and also off the local IP. Also, the routing has been changed to allow cross-domain SignalR connectivity in Global.asax.cs:
RouteTable.Routes.MapHubs(new HubConfiguration() { EnableCrossDomain = true });
The Windows Phone client code is changed to:
HubConnection chatConnection = new HubConnection("http://<LocalIP>:53478/");
But this continues to fail the connection.start() with a "Remote server returned an error: Not Found" exception. I have Fiddler sniffing network traffic from the phone emulator and shows absolutely nothing in response to the connection.start() call.
What am I missing? Any pointers would be helpful .. thanks!
Figured it out myself. Turns out the SignalR connectivity issue from the WPDev emulator was actually due to IIS/Windows security. Little more IIS config & opening local ports through Windows Firewall fixed the problem. Will blog about it; but these two posts helped:
http://msdn.microsoft.com/en-us/library/windowsphone/develop/jj684580.aspx
https://blogs.iis.net/robert_mcmurray/archive/2013/08/20/connecting-the-windows-phone-8-emulator-to-web-api-applications-on-a-local-computer.aspx