Amphtml: Evalution error when replacing an amp-list src with full http localhost paths using amp-bind

[devanes]

What's the issue?

When developing on localhost, an amp-list source like 'http://localhostsomepath/amptest/examples1.json' works fine.

However if I try to replace the src using amp-bind with a similar URL, I'm getting an evaluation error like:
amp-bind: Expression evaluation error in "products.listSrc". "http://localhost/somepath/amptest/examples2.json" is not a valid result for [src]

I expect this to be because it's not a https url. Using relative paths it works fine. However I believe localhost paths should be exempt from https checking. This seems to work when using amp-list only, but not when using amp-bind in conjunction with amp-list

How do we reproduce the issue?

Providing a public URL doesn't work, as this is a localhost-only issue. But you can see a working code example using non-localhost urls here:
https://bronsvuur.nl/test/bind-bv.html
If you would download the files (html+json+image) and replace the urls with full localhost paths you should be able to observe the issue.

1. Create an amp-list with an amp-state [src]
2. Using amp-bind (for example a button) try to replace the src from the amp-list with a full localhost path including http://.
3. Observe the error in the console

What browsers are affected?

Firefox, Chrome. I've tried it on Linux only. But I don't think that matters

Which AMP version is affected?

1504040004635

[choumx]

Thanks for filing this issue.

This is actually working as intended because non-HTTPS amp-list[src] are invalid per the spec:

src (required)
The URL of the remote endpoint that returns the JSON that will be rendered within this amp-list. This must be a CORS HTTP service. The URL's protocol must be HTTPS.

https://www.ampproject.org/docs/reference/components/amp-list#src-(required)

[jridgewell]

I thought we allowed secure URLs?

[slyapustin]

@choumx I think it should allow to use non secure localhost as well.
As currently (in 1522422854768) we have such validation error message for <amp-list> src attribute:
"source" "must start with "https://" or "//" or be relative and served from either https or from localhost.
https://github.com/ampproject/amphtml/blob/master/src/url.js#L269