Chrome Error: Please use a browser with webcrypto support

[lidel]

Problem / TL;DR

Chrome won't allow access to webcrypto for pages served via HTTP unless it's at localhost.
This means parts of window.ipfs will be broken on non-TLS non-localhost gateways.

• Web Crypto API status:
  • Chrome restricts access to webcrypto since version 60.
  • Firefox is planning to Require [SecureContext] for Web Crypto as well.

How to Reproduce

1. Open HTTP (non-TLS) page that is also not a localhost in Chrome with window.ipfs experiment enabled
2. Try running window.ipfs.object.put() (try this Example code)
3. Get the error:

   

Background

This is not a bug, it is a feature sort of a thing.

Modern browsers are limiting selected APIs to be available in Secure Contexts only.
Chrome includes webcrypto in this scheme, which means it cannot be accessed when served from insecure origin:

• The WebCrypto API was enabled by default starting in Chrome 37 (August 26, 2014)
  • Access to the WebCrypto API is restricted to secure origins (which is to say https:// pages).

Current list of “secure” origins according to Chrome can be found here:

Secure origins are those that match at least one of the following (scheme, host, port) patterns:

(https, *, *)
(wss, *, *)
(*, localhost, *)
(*, 127/8, *)
(*, ::1/128, *)
(file, *, —)
(chrome-extension, *, —)

That is, secure origins are those that load resources either from the local machine (necessarily trusted) or over the network from a cryptographically-authenticated server. See Prefer Secure Origins For Powerful New Features for more details.

Related discussion on our end: multiformats/js-multihashing-async#22

Potential Solutions

• extend Please use a browser with webcrypto support error in js-multihashing-async to be less ambiguous, include information about the prerequisite of secure context,
  • PR Improve Error on missing webcrypto multiformats/js-multihashing-async#30
• [OPEN QUESTION]
  • should we shim webcrypto when native implementation is not available?
    • prior art: Why the requirement on webcrypto? multiformats/js-multihashing-async#22 (comment)
  • OR should we ensure window.ipfs is available only in secure contexts? (Restricting window.ipfs to Secure Context #476)