webrepl: Doesn't work from https site #5266

Activity

1. Carglglz commented on Feb 4, 2020

   

   Carglglz

   on Feb 4, 2020

   Contributor

   More actions

   Hi @jimmo

   Make webrepl.py on the device support wss

   I have a working version of this (both WebREPL and File Transfer) for MicroPython (and Python too, to test it)
   All the tests I did were with esp32 MicroPython v 1.12 stable version.

   I think the changes are minimal so as soon as #5543 is solved Websocket "secure" for WebREPL and file transfers would be available.
   To make it work it needs a key and certificate in the device and at "user" side:

   webrepl.start(ssl=True) # This will start listening on wss://x.x.x.x:8833
   
   # or to start Normal WebREPL
   
   webrepl.start() # This will start listening on ws://x.x.x.x:8266
   

   I don't know how this would work with https://micropython.org/webrepl/ but since its from a web browser I guess it would need a certificate signed by a CA and not a self-signed certificate (as the ones I used) and modify function connect(url) to wrap the socket in SSL. (I don't know JS either so just guessing...)

   If there is interest in this I could write a post on the forum or do a PR to discuss the code additions and decide the best way to implement it. 👍

   👍React with 👍1Reacted by Jim Mussared
2. jimmo commented on Feb 5, 2020

   

   jimmo

   on Feb 5, 2020

   MemberAuthor

   More actions

   If there is interest in this I could write a post on the forum or do a PR to discuss the code additions and decide the best way to implement it. +1

   Great! Thanks for looking into this. Putting a PR together sounds like a good way forward.

   I didn't think any changes would be required for https://micropython.org/webrepl/ -- just changing the URL to start with wss:// should be sufficient. But I assume you already tested that? You're probably right though that the self-signed cert would be a problem.

   If you can send a PR then I can test it out and find out.
3. Carglglz commented on Feb 5, 2020

   

   Carglglz

   on Feb 5, 2020

   Last edited by Carglglz

   Contributor

   More actions

   PR done! #5611

   I didn't think any changes would be required for https://micropython.org/webrepl/ -- just changing the URL to start with wss:// should be sufficient. But I assume you already tested that? You're probably right though that the self-signed cert would be a problem.

   It tries to connect but all I get is mbedtls_ssl_handshake error, so yes I think It would need some changes to make it work.

   Anyway, I included in the PR a Websocket Python class ('pure' python, no external dependencies),
   So the changes in webrepl.py can be tested.

   The steps would be:

   • Generate a ec key and cert with openssl and name them with the unique id of the device :
     e.g.
     - key: openssl ecparam -out SSL_key30aea4233564.pem -name secp256r1 -genkey
     - cert: openssl req -new -key SSL_key30aea4233564.pem -x509 -nodes -days 365 -out SSL_certificate30aea4233564.pem

   • Convert key and certificate to '.DER' format:
     - key:openssl x509 -in SSL_certificate30aea4233564.pem -out SSL_certificate30aea4233564.der -outform DER
     - cert: openssl ec -in SSL_key30aea4233564.pem -out SSL_key30aea4233564.der -outform DER

   • Put key and cert ('.der') in the device.

   • Start wss: webrepl.start(ssl=True)

   • In Python:
     e.g.

   >>> from websocket_client import BASE_WS_DEVICE
   >>> wss_device = BASE_WS_DEVICE('192.168.1.42', 'mypass', ssl=True, init=True) 
   >>> wss_device.wr_cmd("print('Hello')")
   Hello
   >>> wss_device.close_wconn()
   
4. PsuFan commented on Apr 14, 2022

   

   PsuFan

   on Apr 14, 2022

   More actions

   Slightly off topic and I sent this to [email protected] almost a year ago and it still hasn't been fixed. The http://micropython.org/webrepl/ has been redirecting for me to https, has this been happening for everyone?
5. jimmo commented on May 14, 2022

   

   jimmo

   on May 14, 2022

   MemberAuthor

   More actions

   Looks like HSTS is enabled on micropython.org/webrepl/ now, so the workaround to use http isn't available.

   👍React with 👍1Reacted by fmillion
6. PsuFan commented on May 14, 2022

   

   PsuFan

   on May 14, 2022

   More actions

   Who runs micropython.org? Should be able to turn it off for a page or put it on a subdomain or build micropython to support https ;)
7. jimmo commented on Jul 20, 2022

   

   jimmo

   on Jul 20, 2022

   MemberAuthor

   More actions

   • Load the page from the device instead -- i.e. serve a bare-bones webrepl.html that includes all its resources and content from a remote site (this could be done in ~100 bytes or so... not much more than just a script tag).

   See #8931 for an implementation of this.
8. PsuFan commented on Jul 20, 2022

   

   PsuFan

   on Jul 20, 2022

   More actions

   Interesting… thanks for the work on this!
9. dpgeorge commented on Jul 23, 2022

   

   dpgeorge

   on Jul 23, 2022

   Member

   More actions

   Fixed by 924e55a
10. dpgeorge

    closed this as completedon Jul 23, 2022