Repository navigation
Let the site run locally over plain http - #570
Merged
Merged
Conversation
The upgrade-insecure-requests CSP meta made the browser fetch every asset over https. On a Herd site that hasn't been secured those requests fail, Alpine never loads, and the x-cloak on <body> keeps the page blank. Leave the meta out when APP_ENV is local so a fresh clone or worktree can be previewed over plain http. Other environments still get it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A fresh clone or worktree served by Herd at
http://<folder>.testshows a blank white page until you runherd secure. This lets it render over plain http.Why it was blank
All three layouts (
layout,layouts/auth,layouts/dashboard) have this in the head:Laravel builds asset URLs from the current request, so the page asks for
http://<folder>.test/build/assets/.... The CSP tells the browser to fetch those over https instead. A site that hasn't been secured has no certificate, so every CSS and JS request fails. Alpine never boots, and because<body>hasx-cloak, Livewire's[x-cloak] { display: none }rule keeps the whole page hidden. The HTML is all there, you just can't see it.Nothing in the app forces https (no
forceScheme, no HSTS). The main checkout only redirects to https because Herd does that for secured sites.The fix
The meta tag is now left out when
APP_ENVislocal. Every other environment still gets it, so production behaves exactly as before. I kept it outside local on purpose:TrustProxiestrusts no proxies, so if production sits behind something that terminates TLS, Laravel probably sees plain http and builds http asset URLs. The CSP meta is likely what stops those being blocked as mixed content there.Secured local sites (
herd secure) still work, since their asset URLs are already https.Testing
http://nativephp.com--local-http.test/docs/mobile/4/the-basics/routing. All five CSS and JS requests went to https and failed./loginrender normally with no failed requests.UpgradeInsecureRequestsTestchecks the main, auth and dashboard layouts include the meta in production and leave it out locally.PluginSyncServiceTest"Could not discover latest release" log count, andSupportTicketTest"only internal notes can be pinned") fail the same way on a cleanorigin/maincheckout, so they are not from this change.🤖 Generated with Claude Code