MagicMirror Forum

    • Register
    • Login
    • Search
    • Recent
    • Tags
    • Unsolved
    • Solved
    • MagicMirror² Repository
    • Documentation
    • Donate
    • Discord

    Electron Security Issues

    General Discussion
    5
    18
    552
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • mumblebaj
      mumblebaj Project Sponsor last edited by

      Hi all, Is there a bigger issue with the CORS policy updates? I have noticed the below warnings in the Developer window.

      03b5d84f-81f3-4758-9e45-e222f6bfa9ba-image.png
      7c75540e-35d6-428b-8748-638ef1ac26eb-image.png

      The list goes. Are there any recommendations on how to get rid of this? The CORS policy update seems to be affecting other modules that now stopped working as the responses are being blocked.

      Would downgrading the Electron version resolve this or is a lower version not compatible with v2.18?

      S 1 Reply Last reply Reply Quote 0
      • S
        sdetweil @mumblebaj last edited by

        @mumblebaj I don’t know the answers, but the insecure warning is because we use http

        electron doesn’t know our usage model, and the web standards have changed to only use https.

        Sam

        Create a working config
        How to add modules

        mumblebaj 1 Reply Last reply Reply Quote 0
        • mumblebaj
          mumblebaj Project Sponsor @sdetweil last edited by

          Thanks @sdetweil. I have noticed that. Is there plans on making changes to align to https?

          S 1 Reply Last reply Reply Quote 0
          • S
            sdetweil @mumblebaj last edited by

            @mumblebaj https is SUCH a pain in the rear, as you have to create a certificate,

            cert requires a registered domain name(with a ip address) , and almost never are free, and expire and …

            and self signed certs are more trouble than they are worth…

            and >98% of the mirrors are internal to the house/office so no one outside can access, and <10% have any app access to the local system, (remote control and such) …

            CORS is controlled by the SERVER not the client… some servers are rejecting weird client browser types (MagicMirror, not chrome or firefox), and some don’t like the 0.0.0.0 address that gets sent,
            and some modules are using request (which has a problem here, one of the reasons for its deprecation) and some modules are using axios/… which are enforcing more…
            and electron is changing too…

            Sam

            Create a working config
            How to add modules

            mumblebaj 2 Replies Last reply Reply Quote 0
            • mumblebaj
              mumblebaj Project Sponsor @sdetweil last edited by

              @sdetweil Yep, understood. node-fetch has also had some changes which could cause some issues in future. I am trying to see if I can fix the MMM-Hue module and it calls out to a bridge which sits on the local network and runs into this CORS issue. Other modules have the same issue. This is going to make module dev a bit difficult, but I am sure we will adapt. 😎

              karsten13 1 Reply Last reply Reply Quote 0
              • karsten13
                karsten13 @mumblebaj last edited by

                @mumblebaj

                the warnings are normal, see https://github.com/electron/electron/blob/main/docs/tutorial/security.md#electron-security-warnings and you can disable them

                @sdetweil

                I agree that https is a pain but I think we will be forced to use it

                @mumblebaj

                I am trying to see if I can fix the MMM-Hue module and it calls out to a bridge which sits on the local network and runs into this CORS issue.

                I see no chance to do this in the module. I found a first (ugly) workaround and will post this in the other thread later …

                mumblebaj S 2 Replies Last reply Reply Quote 0
                • mumblebaj
                  mumblebaj Project Sponsor @karsten13 last edited by mumblebaj

                  Thanks @karsten13. Will await your post there. I am rewriting the module but am running into all kinds of issues. It is ugly. 😞

                  1 Reply Last reply Reply Quote 0
                  • mumblebaj
                    mumblebaj Project Sponsor @sdetweil last edited by

                    @sdetweil Have you seen these errors before? Mirror still starts though. I have just noticed it now as I usually start my mirror from the cron.

                    [04.01.2022 19:49.27.681] [LOG]   Connecting socket for: MMM-Remote-Control
                    [04.01.2022 19:49.27.686] [LOG]   Starting node helper for: MMM-Remote-Control
                    [04.01.2022 19:49.27.724] [LOG]   Connecting socket for: calendar
                    [04.01.2022 19:49.27.729] [LOG]   Starting node helper for: calendar
                    [04.01.2022 19:49.27.732] [LOG]   Sockets connected & modules started ...
                    [04.01.2022 19:49.29.057] [LOG]   Launching application.
                    [28306:0104/194931.715456:ERROR:viz_main_impl.cc(161)] Exiting GPU process due to errors during initialization
                    [04.01.2022 19:49.33.896] [ERROR] ERROR! Could not find main module js file for MagicMirror-backup-restore
                    [28425:0104/194936.968648:ERROR:viz_main_impl.cc(161)] Exiting GPU process due to errors during initialization
                    [28481:0104/194939.078132:ERROR:viz_main_impl.cc(161)] Exiting GPU process due to errors during initialization
                    [28499:0104/194939.733204:ERROR:sandbox_linux.cc(376)] InitializeSandbox() called with multiple threads in process gpu-process.
                    
                    S 1 Reply Last reply Reply Quote 0
                    • S
                      sdetweil @mumblebaj last edited by sdetweil

                      @mumblebaj looks like MagicMirror-backup-restore is in the modules folder… should be in the users root, as it’s not a MagicMirror ‘module’

                      mv ~/MagicMirror/modules/MagicMirror-backup-restore ~
                      

                      Sam

                      Create a working config
                      How to add modules

                      mumblebaj 1 Reply Last reply Reply Quote 0
                      • mumblebaj
                        mumblebaj Project Sponsor @sdetweil last edited by

                        @sdetweil Thanks Sam. That sorted it.

                        1 Reply Last reply Reply Quote 0
                        • 1
                        • 2
                        • 1 / 2
                        • First post
                          Last post
                        Enjoying MagicMirror? Please consider a donation!
                        MagicMirror created by Michael Teeuw.
                        Forum managed by Paul-Vincent Roll and Rodrigo Ramírez Norambuena.
                        This forum is using NodeBB as its core | Contributors
                        Contact | Privacy Policy