Wait what does embedded JS have to do with it? If it’s HTTPS the JS will still run and still be able to do whatever it did before AFAIK.
HTTPS is about MitM attacks.
Comment on Do I need https on everything
GreenKnight23@lemmy.world 2 days ago
if you’re accessing over the internet, always use TLS/HTTPS.
if you’re accessing over LAN, you should still use TLS/HTTPS.
just because you’re hosting the app locally doesn’t mean the JS embedded in the page is safe. HTTPS will ensure that all your traffic is encrypted so only you and the server knows what it contains.
asdfasdfasdf@lemmy.world 2 days ago
jsnfwlr@lemmy.ml 2 days ago Adding to this, the only time I dont use HTTPS/TLS is when I am accessing localhost, prior to moving a service to a subdomain to give it HTTPS/TLS…
hirihit640@sh.itjust.works 2 days ago
if the JS on the page is unsafe then HTTPS wouldn’t help right? The JS could scrape all the info client-side and extradite it.
AFAIK the reason why you’d use HTTPS on your LAN is if you’re afraid of middleman attacks in your LAN, like a malicious device that pretends to be the internet router.
GreenKnight23@lemmy.world 1 day ago
it would if it’s importing something else.
let’s say your site is on app.home.com and your js is locally sourced. then that JS was injected with an import from vuln.evil.com.
I’m pretty sure your browser would block it based on the fact that the document domain is using HTTPS and HSTS would block it based on not using HTTPS.
I think. never really tried this out tbh.