From 86080e68b2a23b0759d81509c3bf47ad254f5ce7 Mon Sep 17 00:00:00 2001
From: Morris Jobke <hey@morrisjobke.de>
Date: Thu, 17 Jun 2021 10:01:31 +0200
Subject: Allow WebAuthn on localhost as well

* browsers typically whiteliste this as well - https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API
* for developing purposes see https://developer.chrome.com/docs/devtools/webauthn/

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
Signed-off-by: Louis Chemineau <louis@chmn.me>
---
 core/src/components/login/PasswordLessLoginForm.vue | 8 ++++++--
 core/src/login.js                                   | 1 +
 core/src/views/Login.vue                            | 5 +++++
 3 files changed, 12 insertions(+), 2 deletions(-)

(limited to 'core/src')

diff --git a/core/src/components/login/PasswordLessLoginForm.vue b/core/src/components/login/PasswordLessLoginForm.vue
index df774599f92..0203bd74c48 100644
--- a/core/src/components/login/PasswordLessLoginForm.vue
+++ b/core/src/components/login/PasswordLessLoginForm.vue
@@ -1,5 +1,5 @@
 <template>
-	<form v-if="isHttps && hasPublicKeyCredential"
+	<form v-if="(isHttps || isLocalhost) && hasPublicKeyCredential"
 		ref="loginForm"
 		method="post"
 		name="login"
@@ -32,7 +32,7 @@
 	<div v-else-if="!hasPublicKeyCredential">
 		{{ t('core', 'Passwordless authentication is not supported in your browser.') }}
 	</div>
-	<div v-else-if="!isHttps">
+	<div v-else-if="!isHttps && !isLocalhost">
 		{{ t('core', 'Passwordless authentication is only available over a secure connection.') }}
 	</div>
 </template>
@@ -73,6 +73,10 @@ export default {
 			type: Boolean,
 			default: false,
 		},
+		isLocalhost: {
+			type: Boolean,
+			default: false,
+		},
 		hasPublicKeyCredential: {
 			type: Boolean,
 			default: false,
diff --git a/core/src/login.js b/core/src/login.js
index c496c7476cf..9a2507e4798 100644
--- a/core/src/login.js
+++ b/core/src/login.js
@@ -71,6 +71,7 @@ new View({
 		hasPasswordless: fromStateOr('webauthn-available', false),
 		countAlternativeLogins: fromStateOr('countAlternativeLogins', false),
 		isHttps: window.location.protocol === 'https:',
+		isLocalhost: window.location.hostname === 'localhost',
 		hasPublicKeyCredential: typeof (window.PublicKeyCredential) !== 'undefined',
 		hideLoginForm: fromStateOr('hideLoginForm', false),
 	},
diff --git a/core/src/views/Login.vue b/core/src/views/Login.vue
index 90c163fc3d5..1372f40b112 100644
--- a/core/src/views/Login.vue
+++ b/core/src/views/Login.vue
@@ -73,6 +73,7 @@
 					:inverted-colors="invertedColors"
 					:auto-complete-allowed="autoCompleteAllowed"
 					:is-https="isHttps"
+					:is-localhost="isLocalhost"
 					:has-public-key-credential="hasPublicKeyCredential"
 					@submit="loading = true" />
 				<a href="#" @click.prevent="passwordlessLogin = false">
@@ -176,6 +177,10 @@ export default {
 			type: Boolean,
 			default: false,
 		},
+		isLocalhost: {
+			type: Boolean,
+			default: false,
+		},
 		hasPublicKeyCredential: {
 			type: Boolean,
 			default: false,
-- 
cgit v1.2.3