docs: qualify Freighter HTTPS requirement for localhost - #2851
Open
devtechedge wants to merge 2 commits into
Open
docs: qualify Freighter HTTPS requirement for localhost#2851devtechedge wants to merge 2 commits into
devtechedge wants to merge 2 commits into
Conversation
http://localhost and http://127.0.0.1 are secure contexts per the W3C Secure Contexts specification, so the blanket HTTPS requirement gave the wrong impression for local development. Keep the HTTPS setup steps as optional. Fixes stellar#2773
Contributor
There was a problem hiding this comment.
Pull request overview
Clarifies Freighter’s HTTPS guidance for localhost development.
Changes:
- Documents loopback HTTP as a secure context.
- Keeps HTTPS setup instructions optional.
Suppressed comments (1)
docs/build/guides/dapps/frontend-guide.mdx:78
- This paragraph now makes a normative browser/security-context claim, but it only names the W3C specification and does not link to it. Please add the cited specification URL so readers can verify the localhost/loopback exception (the linked issue explicitly calls for this citation).
Freighter wallet requires a secure connection to interact with your dapp. Browsers treat `http://localhost` and `http://127.0.0.1` as secure contexts per the W3C Secure Contexts specification, so local development over plain HTTP works without extra setup. To enable HTTPS on localhost anyway, you can use a tool like `mkcert`. Fortunately, Next.js provides built-in support for HTTPS.
Note
Copilot is running an experiment and ran this review at Lite.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| ### Setup HTTPS on Localhost | ||
|
|
||
| Freighter wallet requires a secure connection (HTTPS) to interact with your dapp. To enable HTTPS on localhost, you can use a tool like `mkcert`. Fortunately, Next.js provides built-in support for HTTPS. | ||
| Freighter wallet requires a secure connection to interact with your dapp. Browsers treat `http://localhost` and `http://127.0.0.1` as secure contexts per the W3C Secure Contexts specification, so local development over plain HTTP works without extra setup. To enable HTTPS on localhost anyway, you can use a tool like `mkcert`. Fortunately, Next.js provides built-in support for HTTPS. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
The dapp frontend guide stated one unqualified requirement: "Freighter wallet requires a secure connection (HTTPS) to interact with your dapp", then pointed readers at HTTPS setup for localhost.
http://localhostandhttp://127.0.0.1are alreadyPotentially Trustworthyorigins under the W3C Secure Contexts specification, so plain HTTP on loopback satisfies Freighter's secure-context requirement and the sentence overstates what is needed.The paragraph now names the loopback exception and keeps the HTTPS setup steps as optional. Nothing else in the guide changes.
Fixes #2773
Testing
Docs-only change; verified the surrounding section still reads correctly and the mkcert /
next dev --experimental-httpssteps remain intact.