Testing Geolocation from localhost or equivalent

[andyg...@gmail.com]

What's the recommendation for all front-end developers testing Geolocation from localhost or its equivalent going forward?

I've read the Deprecating Powerful Features on Insecure Origins documentation and related FAQs that apply to following error but I'm confused because the FAQ says that HTTP will still be allowed, but it doesn't clarify the use of localhost:

"getCurrentPosition() and watchPosition() are deprecated on insecure origins, and support will be removed in the future. You should consider switching your application to a secure origin, such as HTTPS. See https://goo.gl/rStTGz for more details."

I believe this applies to development on origins related to or similar to the following when served locally:

localhost/
web.local/
192.168.x.x/
etc.

Not all front-end dev shops will be able to remote into a non-local server for development and testing. Furthermore, this potentially places a significant burden to use multiple machines or production/external web servers for testing and continuous integration development patterns where a single machine is significantly more desirable.

Additional Reference: https://sites.google.com/a/chromium.org/dev/Home/chromium-security/marking-http-as-non-secure

[Lucas Garron]

localhost testing will definitely be supported, because it is a "privileged context". See the links from that page:

https://sites.google.com/a/chromium.org/dev/Home/chromium-security/prefer-secure-origins-for-powerful-new-features

https://w3c.github.io/webappsec/specs/powerfulfeatures/#is-origin-trustworthy

»Lucas

[andyg...@gmail.com]

Excellent. Thanks for clarifying.

[andyg...@gmail.com]

Localhost testing is currently failing with "POSITION_UNAVAILABLE" messages and timeout errors when using desktop Chrome and Chrome Canary. This has been verified on a number of different networks.

Chrome version: 44.0.2403.157
Chrome Canary version: 47.0.2493.0 canary (64-bit)

Please advise on whether insecure localhost testing capabilities have been disabled in Chrome?

[PhistucK]

Does it work on secure, external hosts?

☆PhistucK

To unsubscribe from this group and stop receiving emails from it, send an email to security-dev...@chromium.org.

[Joel Weinberger]

If it doesn't work on localhost, that would be a bug. As Lucas mentioned, localhost should always be supported as a 'Privileged Context,' but in any case, we haven't made any changes to the support of Geolocation yet, so anything that disabled its support would be a bug.

--Joel

[andyg...@gmail.com]

@PhistucK no, it does not seem to be working from HTTPS in Chrome. Chrome Canary isn't returning anything.

To clarify:
- Using getCurrentPosition()
- The position object is being returned
- position.coords.latitude always seems to equal zero
- position.coords.longitude always seems to equal zero
- position.coords.accuracy is returning a value

[PhistucK]

Then file an issue at crbug.com, if you cannot find an existing similar issue there.

☆PhistucK

[andyg...@gmail.com]

Issue opened: https://code.google.com/p/chromium/issues/detail?id=527103