Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: simpler https audit #1918

Merged
merged 5 commits into from
Mar 28, 2017
Merged

fix: simpler https audit #1918

merged 5 commits into from
Mar 28, 2017

Conversation

patrickhulce
Copy link
Collaborator

@patrickhulce patrickhulce commented Mar 27, 2017 •
edited
Loading

fixes #1904

Moves the HTTPS audit to a simpler method just ensuring no requests were loaded over http more debuggable and informative to the user as well which URLs need to be https. Also considers localhost to be secure to fix #1175

@brendankenny
Copy link
Member

it is nice to match Chrome's/devtools' notions of security, though, and not have to update to match when it changes (e.g. neutral today for mixed content images may someday be more strict).

Would it make sense to still do driver.getSecurityState, keep the whole security state object, not just state.schemeIsCryptographic so we can get the reasoning, and then combine it with record counts in the audit (like it appears the Security panel does too now)?

We can definitely ditch all the timeout nonsense. That's from ancient times, and if we actually needed to worry about every driver call timing out, Lighthouse as a whole would be in a ton of trouble :)

paulirish
paulirish requested changes Mar 27, 2017
View reviewed changes
lighthouse-core/audits/is-on-https.js Outdated
@@ -41,9 +43,25 @@ class HTTPS extends Audit {
* @return {!AuditResult}
*/
static audit(artifacts) {
const networkRecords = artifacts.networkRecords[Audit.DEFAULT_PASS];
const insecureRecords = networkRecords
.filter(record => record.scheme === 'http' && record.domain !== 'localhost')
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i'd prefer to whitelist what we consider secure, rather than building up a blacklist.

check out https://www.chromium.org/Home/chromium-security/security-faq#TOC-Which-origins-are-secure-
i think we only want to do https/wss and localhost for now.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

lighthouse-core/test/runner-test.js Outdated
@@ -46,7 +46,7 @@ describe('Runner', () => {
const url = 'https://example.com';
const config = new Config({
audits: [
'is-on-https'
'theme-color-meta'
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

im just about to nuke this guy. ;) can you use another

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

😢

@paulirish
Copy link
Member

Would it make sense to still do driver.getSecurityState,

basically the Security domain isn't implemented on Android, and hasn't been for over a year. So, while I don't really want to, i think we have to drop that approach and determine the basic security state on our own.

paulirish
paulirish approved these changes Mar 28, 2017
View reviewed changes
Copy link
Member

@paulirish paulirish left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

two nits, but otherwise im happy with this.

lighthouse-core/test/runner-test.js Outdated
HTTPS: {
value: true
}
ViewportDimensions: '#ffffff'
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

white dimensions? that's kinda fun.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

heh, this turns out this value is meaningless to tests then :)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it's not testing that the content-width didn't throw an error, though, just that the artifacts make it through. Should still update the assertion value to something less confusing for the next reader

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

lighthouse-core/audits/is-on-https.js
let displayValue = '';
if (insecureRecords.length > 1) {
displayValue = `${insecureRecords.length} insecure requests found`;
} else if (insecureRecords.length === 1) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks like we're setting the same displayValue in both cases.
Regardless, I'm +1 on ignoring the pluralization issue and keeping the impl simple.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What about one string to rule them all:

if (insecureRecords.length) {
  displayValue = `Insecure requests: ${insecureRecords.length}`;
}

We should handle the pluralization though. #polish

brendankenny
brendankenny reviewed Mar 28, 2017
View reviewed changes
lighthouse-core/test/runner-test.js Outdated
@@ -153,17 +151,17 @@ describe('Runner', () => {
const config = new Config({
audits: [
// requires the HTTPS artifact
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ViewportDimensions

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

lighthouse-core/test/runner-test.js Outdated
HTTPS: {
value: true
}
ViewportDimensions: '#ffffff'
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it's not testing that the content-width didn't throw an error, though, just that the artifacts make it through. Should still update the assertion value to something less confusing for the next reader

@patrickhulce patrickhulce merged commit 33f1c38 into master Mar 28, 2017
@patrickhulce patrickhulce deleted the fix_https_audit branch March 28, 2017 18:57
@paulirish paulirish mentioned this pull request Mar 28, 2017
Merged
paulirish added a commit that referenced this pull request Apr 22, 2017
@paulirish
Manual merge of #1918 https audit fix. 1/2
74bb788
@paulirish paulirish mentioned this pull request Apr 22, 2017
Merged
paulirish added a commit that referenced this pull request Apr 22, 2017
@paulirish
Cherrypick https audit fix (original pr #1918) to 1.6 (#2054)
3852ead
@patrickhulce patrickhulce mentioned this pull request May 17, 2017
Merged
@brendankenny brendankenny mentioned this pull request May 30, 2017
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ebidel ebidel ebidel left review comments

@brendankenny brendankenny brendankenny left review comments

@paulirish paulirish paulirish approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

"Uses HTTPS" result is incorrect on WPT Skip HTTPS tests when running a 127.0.0.1 or localhost or .local URL
4 participants
@patrickhulce @brendankenny @paulirish @ebidel