Optionally serve browser platform over HTTPS

[mgatto]

Feature Request

Motivation Behind Feature

In some development environments, an API is served over SSL via the protocol https. Communicating with that API from a Cordova browser instance on a developer's machine is very efficient work flow. However, modern browsers disallow cross-origin communications between insecure and secured servers. In this case, the secured server is the API, and the insecure server is the current cordova-browser instance served with Node's http module. This is because it is always served without SSL.

Feature Description

The parent issue is in the cordova-browser repo with a full description, partially reproduced in this ticket: apache/cordova-browser#122

Alternatives or Workarounds

Exposing the API over non-secure http is an alternative. In my context, this was rejected strongly for security reasons, especially relating to corporate security accountability programs.

The second is that a developer independently hacks their local cordova installation to enable https. This is suboptimal since upgrading becomes a hassle, requiring careful VCS audits to restore erased, custom code.

[erisu]

Have you looked into adding platform specific parameters instead of adding to this CLI repo?

Usually platform specific commands are separated by extra double hyphens...

cordova build <platform> <cli-flags> -- <platform-flags>

For example in Android you can see the command below showing Android own defined flags...

cordova run android -- --gradleArg=-PcdvMinSdkVersion=20

If my memory is correct, you will not find gradleArg defined anywhere in this repo or supporting libraries... But is in the platform repo.

I believe in this case, https, flag would fall into the same category.

[mgatto]

This is a good idea, and thanks for making me aware of this alternative. I'll close this issue and move my code to cordova-serve instead.