Preact-cli: Service worker on localhost

[prateekbh]

@lukeed @developit
this is in reference to #30 bug.
we are deliberately stopping sw from non secure localhost. It might be worth looking into whether or not we want this to continue.

I tried running a new app with npm run serve but i my browsers does not identify the certificate, hence blocking the sw from getting active.

[lukeed]

Hmm... Looks like the cert error should be a separate issue (you're not the first with this, although it works for me). Once that's resolved, the npm run serve will register a SW for you.

But, this is about locahost blocking 😉

My main point from last night was that I don't think offline caching should be on by default for development/HMR. We may ofc disagree on this, but I've seen this cause more confusion for the average developer who may not have SW experience. Of course, there's no problem using SW in dev if you're familiar with SW & what behaviors it implies.

@developit suggested in Slack that we could specify when the CLI should enable the offline behavior. I'm a fan of this!

Taking that suggestion & my personal off-by-default preference, we can pass a --offline flag to preact watch, which would enable SW caching while using the HMR server. And preact build would (hypothetically) continue to output production-ready registration code, since that is the "production" command.

[developit]

One thing to add to this - for those using a ServiceWorker for more than just offline (push, caching, etc), it's less optional during development.

[prateekbh]

totally agreed, with push coming in/ background sync it makes sw far less than optional

[gokulkrishh]

@developit Also after running preact serve and coming back npm run start site will always loads in https://localhost:8080, unless I use www.localhost:8080 or clear my caches. Is it is due to certificate generated for http2??

[prateekbh]

@lukeed @developit do we have a conclusion of this thing yet?

[lukeed]

@gokulkrishh I don't think it's the certificate specifically, but simplehttp2server will redirect HTTP to HTTPS (see https://github.com/GoogleChrome/simplehttp2server/issues/16). The browser will remember the Upgrade-Insecure-Requests header & continue that behavior for the same localhost:port combination.

You will have to empty cache in order to fix this.

@prateekbh @developit Found a good summation of why I (still) think SW should be off by default: https://twitter.com/dan_abramov/status/869165916378075136

[gokulkrishh]

@lukeed Yep. I understood that. Yes I am clearing cache and making it work. Thanks

[derappelt]

B2T
Download:
https://raw.githubusercontent.com/developit/preact-cli/master/src/resources/cert.pem
and add it to your System trusted certificates.
On MacOs it's simple as click on the file add it to Keychain, right click it "Get Info" and under "Trust" switching "Secure Sockets Layer (SSL)" to "Always trust"
Don't forget to restart your browser.

Alternatively:
Buy a signed certificate or generate your own self signed and replace the preact-cli cert.pem with this one.

[developit]

We've removed the root CA since it opens up a fairly nasty vulnerability that lets anyone who can get access to your connection spoof any SSL certificate. Instead, preact-cli now uses devcert to generate SSL certificates that are only valid for your machine.