mirror of
https://github.com/floccusaddon/floccus.git
synced 2026-04-26 06:35:59 +03:00
[GH-ISSUE #59] Handling of Secure Connection Errors #59
Labels
No labels
browser-specific
bug
correctness issues
enhancement
feature: Google Drive
feature: Linkwarden
feature: git
feature: nextcloud-bookmarks
feature: tabs
feature: webdav
help wanted
native-app
priority: high
priority: low
priority: medium
pull-request
question
question
stale
upstream
waiting for more information
wontfix
🙁 Not following issue template
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/floccus#59
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @SomePoorBastard on GitHub (Mar 25, 2018).
Original GitHub issue: https://github.com/floccusaddon/floccus/issues/59
Software versions
Browser(s):
Google Chrome
chrome://version
Firefox
(To Be Amended on next test case)
Nextcloud: 13.0.1
Nextcloud Bookmarks app: 0.11.0
Floccus: 2.0.0
Steps to reproduce
Expected outcome
One of two outcomes:
...
Actual outcome
...
Additional Information
Floccus Logfile (Scrubbed of P.I.I. & replaced with dummy data)
Notes
The first two errors I believe were when when I forced a sync with development mode off. After turning development mode on, then opening the console and attempted to reproduce in front of my eyes, it successfully completed a synchronization. lol...
@marcelklehr commented on GitHub (Mar 25, 2018):
Mh. Are you able to login using the normal nextcloud frontend in the same browser? The fact that it worked the second time you tried is strange, as a certificate error usually doesn't resolve itself. It might be that nextcloud banned your ip after too many requests before?
@SomePoorBastard commented on GitHub (Mar 25, 2018):
I had definitely logged in just before according to my web history, but it's hard to say exactly what happened without diving into the server logs. I'll take a peek at those shortly.
@SomePoorBastard commented on GitHub (Mar 27, 2018):
I'm not sure how long a ban lasts in Nextcloud's brute-force detection blacklist. Here is a snip from the logs at the time; starting at the time the requests were made:
Not much to go on from a report's perspective. The only peculiar thing is the GET requests which specify a bookmark with a negative number for a page.
Anyways, I have changed the certificate used by the web-server of my Nextcloud Instance so the SAN matches the IP address I have set up for it. While I also have a DNS name inside the SAN, the DNS server is on a different network segment than the device I am using with Firefox. The device using Chrome however, is on the same network segment, but did not yet trust the certificate because it did not trust the CA the certificate was issued through. I have fixed this and can confirm that I have had no further problems on my end.
Since you seem to be using a specific API to implement this for Firefox, I believe that choosing to trust or distrust self-signed certificates is out-of-scope, despite my preferences to have such a feature included. I imagine this functionality would simply defer to the browser's trust with the Nextcloud Instance accessed. It would be a low-priority, but useful feature however to determine whether a connection is insecure, and simply refuse to use it unless it is acceptably secure.
I'll leave it to you to close as "will not implement", or keeo open as a future feature request.
@marcelklehr commented on GitHub (Mar 27, 2018):
I'm glad it works for you, now. :) I've improved error handling for network errors, so it's more obvious what is the problem with this kind of errors. Disallowing raw http URLs seems like a good idea, though! I will open a separate issue for this :)
@github-actions[bot] commented on GitHub (Mar 21, 2023):
This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.