--unsafely-treat-insecure-origin-as-secure="http://example.com"

3,978 views
Skip to first unread message

Arwa A

unread,
May 15, 2017, 11:27:33 AM5/15/17
to securi...@chromium.org
hello 
how i can use the secure connection 
more specifically how i can write it correctly by using this
  1. You can run chrome with the --unsafely-treat-insecure-origin-as-secure="http://example.com" flag (replacing "example.com" with the origin you actually want to test), which will treat that origin as secure for this session. Note that you also need to include the --user-data-dir=/test/only/profile/dir to create a fresh testing profile for the flag to work. Note that on Android and ChromeOS this requires having a device with root access/dev mode.

what do you mean by --user-data-dir=/test/only/profile/dir ?

each time i write it, it goes to the normal search

and thank you

Eric Lawrence

unread,
May 15, 2017, 11:34:44 AM5/15/17
to Arwa A, Security-dev
The idea is that, to prevent compromising data in your user profile, you must use a "temporary" profile path when using the --unsafely... option.

So, for instance, http://html5demos.com/geo is a HTTP page that tries to use the Geolocation API. This is disallowed by the security policy that says only HTTPS pages may request geolocation.

For testing purposes, you can instruct Chrome to treat "http://html5demos.com" as a secure origin, but for that flag to take effect, you must also specify a user-data-dir so that the Chrome instance runs in a temporary profile.

For instance, to achieve this on Windows, you'd use a command line like so:

chrome --unsafely-treat-insecure-origin-as-secure="http://html5demos.com/" --user-data-dir="C:\temp\ChrTemp" http://html5demos.com/geo

-Eric
Reply all
Reply to author
Forward
0 new messages