localhost-https
Advanced tools
+1
-1
| { | ||
| "name": "localhost-https", | ||
| "version": "1.0.12", | ||
| "version": "1.0.13", | ||
| "main": "index.js", | ||
@@ -5,0 +5,0 @@ "scripts": { |
+5
-11
| # Localhost Cert | ||
| # Localhost Https / Localhost Cert | ||
@@ -21,3 +21,3 @@ ## A secure and convenient solution for enabling HTTPS on localhost | ||
| To ensure that the private key is not remembered, Localhost Cert utilizes GitHub Actions to generate the root certificate. The process of generating the certificate and the code at that time are fully traceable on GitHub. If you're interested, you can view the [GitHub Action](https://github.com/IdeaNest-org/localhost-cert/actions/runs/7004987626/job/19053845251) for more details. | ||
| To ensure that the private key is not remembered, Localhost Cert utilizes GitHub Actions to generate the root certificate. The process of generating the certificate and the code at that time are fully traceable on GitHub. If you're interested, you can view the [GitHub Action](https://github.com/IdeaNest-org/localhost-cert/actions/runs/7056302734) for more details. | ||
@@ -31,3 +31,3 @@ In summary, it is completely secure due to two reasons: | ||
| ```bash | ||
| npm install localhost-cert --save-dev | ||
| npm install localhost-https --save-dev | ||
| ``` | ||
@@ -43,6 +43,3 @@ | ||
| devServer: { | ||
| https: getHttps({ | ||
| // If the developer has not installed the root certificate, they will be guided to install it. | ||
| autoInstall: true, | ||
| }), | ||
| https: getHttps(), | ||
| }, | ||
@@ -57,6 +54,3 @@ }; | ||
| server: { | ||
| https: getHttps({ | ||
| // If the developer has not installed the root certificate, they will be guided to install it. | ||
| autoInstall: true, | ||
| }), | ||
| https: getHttps(), | ||
| }, | ||
@@ -63,0 +57,0 @@ }); |
+4
-7
@@ -1,2 +0,2 @@ | ||
| # Localhost Cert | ||
| # Localhost Cert / Localhost Https | ||
@@ -16,3 +16,3 @@ ## 一个安全、便捷的 localhost 支持 HTTPS 的方案 | ||
| 如果你对 HTTPS 有一定的了解,那么你应该知道如果在本地安装一个 CA 根证书,这是一个很危险的事,因为这个根证书可以用于签名任何域名比如,google.com. 从而达到中间人劫持,但是 Localhost Cert 生成 localhost 的域名后,立马丢弃了根证书的私钥,也就是说,即便有人想用这个根证书对其他网站签名是不可能的。 | ||
| 那么是如何保证私钥没有被记住呢,Localhost cert 是利用 github action 生成根证书的,github Action 生成的过程以及 github 当时的代码是完全可追踪的,如果感兴趣可以查看[github action](https://github.com/IdeaNest-org/localhost-cert/actions/runs/7004987626/job/19053845251) | ||
| 那么是如何保证私钥没有被记住呢,Localhost cert 是利用 github action 生成根证书的,github Action 生成的过程以及 github 当时的代码是完全可追踪的,如果感兴趣可以查看[github action](https://github.com/IdeaNest-org/localhost-cert/actions/runs/7056302734) | ||
@@ -26,3 +26,3 @@ 总结一下基于两点,它是完全安全的 | ||
| ```bash | ||
| npm install localhost-cert --save-dev | ||
| npm install localhost-https --save-dev | ||
| ``` | ||
@@ -38,6 +38,3 @@ | ||
| devServer: { | ||
| https: getHttps({ | ||
| // 如果开发者没有安装根证书,那么会引导开发者安装根证书 | ||
| autoInstall: true, | ||
| }), | ||
| https: getHttps(), | ||
| }, | ||
@@ -44,0 +41,0 @@ }; |
+1
-3
| const getHttps = require('./index.js'); | ||
| const options = getHttps({ | ||
| autoInstall: true, | ||
| }); | ||
| const options = getHttps(); | ||
| console.log(options); | ||
@@ -6,0 +4,0 @@ const https = require('https'); |
Network access
Supply chain riskThis module accesses the network.
Found 1 instance in 1 package
Shell access
Supply chain riskThis module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.
Found 1 instance in 1 package
Environment variable access
Supply chain riskPackage accesses environment variables, which may be a sign of credential stuffing or data theft.
Found 4 instances in 1 package
Filesystem access
Supply chain riskAccesses the file system, and could potentially read sensitive data.
Found 2 instances in 1 package
Major refactor
Supply chain riskPackage has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.
Found 1 instance in 1 package
Network access
Supply chain riskThis module accesses the network.
Found 1 instance in 1 package
Shell access
Supply chain riskThis module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.
Found 1 instance in 1 package
Environment variable access
Supply chain riskPackage accesses environment variables, which may be a sign of credential stuffing or data theft.
Found 4 instances in 1 package
Filesystem access
Supply chain riskAccesses the file system, and could potentially read sensitive data.
Found 2 instances in 1 package
3
-25%26316
-1.73%460
-0.43%57
-9.52%