WebViews do not load with https and self signed certificates

[nooobcoder]

I use dockerized code-server and this is my docker run command I use every time to spin a container.

This error is also mentioned in #3410 but my problem is a bit different I guess. Please help me @jsjoeio @code-asher @oxy with this.

docker run -it --name code-server --network host -v "${PWD}/.config:/home/coder/.config" -v "${PWD}/data:/home/coder/.local/share/code-server"   -v "/home/ubuntu/VSCodes:/home/coder/project" -v "${PWD}/certs/certs.crt:/home/coder/cert.crt" -v "${PWD}/certs/certs.key:/home/coder/cert.key"  -u "$(id -u):$(id -g)"  -e "USER=$USER"  codercom/code-server:latest --cert /home/coder/certs.crt --cert-key /home/coder/certs.key

Everything works as it should but the webviews do not work at all in Chrome. I did open code-server web ui on Firefox and the webviews do load but in Chrome i have no luck. Why is this so.
For the time being also, Firefox is not the solution, because firefox do not have clipboard access facility to paste text from clipboard into the code-server integrated terminal. I am sharing relevant screenshots to have a better picture of this thing.

Just for your information, I am using the latest Chrome Beta to use code-server.

This might be a self signed certificate thing i guess, and this is the command that i used to generate a Self Signed cert to use code-server in LAN

openssl req \
       -newkey rsa:2048 -nodes -keyout certs.key \
       -x509 -days 365 -out certs.crt

Error on Chrome

Screenshots from Firefox

Just observe that the service worker is registered which was not in Chrome and the WebViews load successfully.

Before you ask for code-server logs, I am mentioning them below, seems like pretty clean to me at least showing no errors

and this is my config.yaml file that I use to serve code-server

bind-addr: 0.0.0.0:8080
auth: password
password: mysupersecretpassword
cert: true

[nooobcoder]

My suggestion: Please let the serviceworker work without a proper cert if possible.
Also a thing to mention, I cannot install code-server as a PWA on my laptop due to this cert error for sure. Earlier I used it, many months back and since then I did not ever got the option to install the PWA of code-server.

DO I need to use some reverse-proxy complicated stuffs for this, please help me out, and I have no knowledge about reverse proxies 😔, if someone has a guide for this, would be helpful too.

[jsjoeio]

Please let the serviceworker work without a proper cert if possible

I wish I knew more about serviceworkers and certs, but my hunch would say this is not a requirement of code-server but rather of the PWAs? I could totally be off-base though.

[code-asher]

Yeah it looks like Chrome doesn't like the certificate and I don't believe we can relax that restriction on the code-server side.

I haven't had a chance to test yet but I wonder if plain --cert with code-server`s own generated cert has the same issue? Maybe the certificate needs extra parameters to be seen as valid by Chrome or something.

[jsjoeio]

Hmm...let's see if we can figure this out together.

Just for your information, I am using the latest Chrome Beta to use code-server.

First things first. If you switch to the current version of Chrome (instead of Beta), does it work as expected?

[nooobcoder]

@jsjoeio I have been very clear with my problem, and I tried with Chrome stable too, however, there is no change at all. This issue is worrying me a lot, the webviews in code-server is not working. I googled and came up with this solution to ignore certificate errors, and this is the command.

google-chrome --ignore-certificate-errors --unsafely-treat-insecure-origin-as-secure=https://192.168.0.120:8080 --user-data-dir=/tmp/foo

Please guide me how do I locally host code-server and still not have issues like this, if you have any guide, then that might help me.

Thank you for the zero-day quick response!

[jsjoeio]

Personally, I am less experienced with setting up SSL certifications, reverse proxies, etc. so I always opt for the hosted option with the least amount of work 😅

Have you checked out deploy-code-server and tried deploying with Railway? They handle a lot of this for you

[frog-o]

A guide on how-to setup this stuff would be greatly appreciated at least by me.

I am having the same error. "https" is a big pain for people in a local domain like me. A big reason to set up a local domain is security. The rule is never give apps more permission that what it need, If we don't need the Internet to do our thing, why do we demand to connecting to it? One things that really bug me is that the a real big push to put everything on-line without concern for those who don't want to.

I feel I am out of options here.
I tried to even use the "--link" option to get around this problem but that did not work it gave me an internal server message.
I look on github for issue with the --link option and found chore: add deprecation notice for --link #456. It looks to me they are plaining to do away with it without any way to replace it. I know nothing about PWA and code-server work but it seem so strange that. Code-server needs a secure connection to get info from itself. Please note I don't have a domain name, I look into the free Domains ones but they are really just subdomain. The info to set up https, so browser will like them does seem to exists. I spent days looking into this. To spend a lot of money in odder to setup something you don't want IMHO is unacceptable.

[code-asher]

Also if you are running locally you can use self-signed certificates.

[code-asher]

Wow somehow I missed the line where @jsjoeio already suggested that. 🤦

[frog-o]

I read the guide but it still does not work thanks anyways @jsjoeio
I was reply to this comment

Please guide me how do I locally host code-server and still not have issues like .

While you guide scratches the suffice there more work need ,like trying the things you metion above. I really don't want my work on online just be able to access it in local domain with my static ip.

• I also tried self-signed server at least i think i did I changed the authority to yes. Its show up in chrome with as "https" wich is crossed out because it is not verify by letsencript. There no way to do this with static IP that i know of; There documenting is hurting about static ip
• I tried the --local flag could not get it to work and they say they going to some better but don't know what. This does not help me now though

Makes sense! Unfortunately the HTTPS requirement is one we don't have a ton of control over (without rewriting code-server/VS Code to not use service workers). Have you tried setting up a self-signed certificate?

yep Thanks. I thinking the same thing ; It very annoying how google and the rest of them are pushing LETENCRIPT but don't support a static domain and breaks everything that is not succured by LETSENCRIPT. At least from what i can tell. That the reason i said I need a guid.

I don't think there is a answer, I was hopping there where more testing somebody could do with self-sing certificates and webviews. I can't go though you code to do this my self (I am just starting to learn javascript) to git rid of the above errors,but I can see why it is not high importance for you. It makes code-server very broken I would say by %50 because a lot won't work, copy and past(there is a work around but not good) for example and forget any previews

[jsjoeio]

Unfortunately, I don't think there is much we can do to help beyond the recommendations we've already made 😢

I also tried self-signed server at least i think i did I changed the authority to yes. Its show up in chrome with as "https" wich is crossed out because it is not verify by letsencript. There no way to do this with static IP that i know of

I don't have a ton of experience here but maybe @code-asher can chime in.

The only other thing I can think of is you could write out reproduction steps and then one of us could try seeing if we run into the same problem (I imagine we would) and then we can try using a self-signed certificate and seeing if it works for us.

[code-asher]

As long as it is using https browser features like service workers and copy/paste should still work even if the browser shows it crossed out.

However according to another issue we have a problem with self-signed certificates so it is possible you are running into that.

#4693