← Back to context

Comment by throwaway0x7E6

4 years ago

neat tool. I would encrypt the payload type and extension tho

>Some browsers disable window.crypto on local files and non-TLS servers

which ones do that?

9 comments

throwaway0x7E6

Reply
jefftk  4 years ago

It is documented [1] as only being available in secure contexts, which is normally https:// but does include file:// urls. Testing now, it works for me in Chrome, Safari, Brave, and Firefox.

If you put:

    <script>
      window.crypto.subtle.generateKey(
        {name: "ECDSA", namedCurve: "P-256"},
        false, ["sign", "verify"])
      .then(function(key){alert(key.publicKey)})
    </script>

in a local HTML file and visit it in your browser, all four browsers alert with "[object CryptoKey]".

[1] https://developer.mozilla.org/en-US/docs/Web/API/Crypto/subt...

[2] https://developer.mozilla.org/en-US/docs/Web/Security/Secure...

mprime1  4 years ago

Brave and Safari that I know of.

i.e. if you run the creator with a simple HTTP server on localhost:8080 it'll block the fetch to localhost:8080/foo