halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions

fix(app)!: instances over plain HTTP are refused, but on this machine

Browse source 
What the app sends an instance (the proofs that sign in, the keys'
wrappings, every request a session carries) must not be read or changed on
the way, so an instance is reached over HTTPS, or over plain HTTP only on
this machine (localhost, 127.0.0.0/8, ::1), as Jellyfin servers are. An
address over plain HTTP elsewhere is refused before anything is sent there.
One kept from before is never opened: the app says why, and offers another
instance or removing it from the device, never dropping it silently.
Development builds still use their own instance over HTTP (an emulator
reaches the developer's machine as 10.0.2.2); releases never.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-21 14:35:21 +02:00
commit 4914df348e
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
1 changed files with 338 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

22
packages/halkyon_app/test/instance/instance_test.dart
View file

@ -48,4 +48,26 @@ void main() {
Instance.parse('https://LEARN.example.org/'),
);
});
test('is reached securely over HTTPS, or over HTTP on this machine only', () {
for (final address in [
'learn.example.org',
'https://learn.example.org:8443/learn',
'http://localhost:8080',
'http://127.0.0.1:8080',
'http://127.1.2.3',
'http://[::1]:8080',
]) {
expect(Instance.parse(address)!.isSecure, isTrue, reason: address);
}
for (final address in [
'http://learn.example.org',
'http://10.0.2.2:8080',
'http://192.168.1.10:8080',
'http://localhost.example.org',
'http://[::2]',
]) {
expect(Instance.parse(address)!.isSecure, isFalse, reason: address);
}
});
}