Connecting extension to alerting server not working

[veeral-patel]

Here's my debug configuration:

As you can see I've set the phishcatch server URL to a ngrok site which points to localhost:8000. I am running the server locally at port 8000 using PRESHARED_KEY=MYPSK123 dev.sh

I am able to trigger phishcatch browser notifications, however I am not seeing any alerts logged by my alert server.

What do I need to do to get the extension and server to cooperate?

[carbureted]

If you run the server locally (ie without ngrok) do you have the same problem? I'll try to reproduce this tomorrow if you're still having problems.

[malcode-eth]

I confirm it can't connect locally.

Either with an IP (127.0.0.1), a domain, by using http or https.

[veeral-patel]

@carbureted neither local or with ngrok work

[carbureted]

You guys are running via docker, right?

[malcode-eth]

Yes, here is how I launched it :

docker run -d -e PRESHARED_KEY=justtesting --name phishcatch -p 8080:80 phishcatch

[0xMirasio]

veeral-patel, it's normal the /alert POST isn't working
There is a CSP policy that isn't allowing to make request to url beginning with http://

the csp policy is : "content_security_policy": "script-src 'self'; object-src 'self'; connect-src https://*",
If you want to your server ngrok to work, you need to add http:// in the CSP policy in manifest.json (/public)
or use the https URL gived by ngrok when requesting a http server.

That issue can be verified by watching background on chrome dev console

[carbureted]

Good catch. I'll update the wiki to note the HTTPS requirement. Do people feel having an https server running is too high of a barrier for initial development?

[0xMirasio]

Well that's not a problem, you can change manifest.json to support http :

"content_security_policy": "script-src 'self'; object-src 'self'; connect-src http://* https://*",

[carbureted]

I could, but it enables hosting prod servers on http. A compromise might be enabling http for all localhost ports.

[veeral-patel]

@carbureted hey -- yes, i think that's a good compromise as well