Deploying to http environment causes error on `loginWithRedirect`

[PaulInglis]

Deploying to http environment causes error on `loginWithRedirect`

[davidgeary]

@stevehobbsdev It may also be worth noting that while localhost is considered a secure origin, locally-defined domains (i.e. entries added to your local hosts file) are not.

So if, for example, you're testing a multi-tenanted app by adding dummy client-specific subdomains to your hosts file - alice.my-app.local, bob.my-app.local and so on - you'll need to run under HTTPS, even if they just point to 127.0.0.1.

[PaulInglis]

Thanks Steve, however I do not see anything in the FAQ which indicates this...

[stevehobbsdev]

@PaulInglis No I know, I raised that comment in error, apologies for that.

To answer your question, yes the SDK must be run on a secure origin as it relies on the crypto APIs being available in the browser to function.

We fully intend to handle this better and surface better messaging from the library when the scenario you've encountered occurs, and it's in our internal backlog to fix.