randomUUID failing due to local insecure host as domain

[Der-Alex]

We are using unleash locally inside a minikube setup. Our setup creates several services and therefore we create local domains like http://myservice.myorg.
We don't use local https because for our local development this was never needed.
Unleash would now be accessible under http://unleash.myorg.
This is a insecure domain and so things like creating a flag would fail, because crypto.randomUUID() should only work in a secure context, as described in mdn: https://developer.mozilla.org/de/docs/Web/API/Crypto/randomUUID

Should this edge case be handled by unleash or is this more of a "bad luck, add cert to your local development"?

[gastonfournier]

Thanks for reporting this. Your diagnosis looks right: http://unleash.myorg is not considered a secure context by browsers, so direct use of crypto.randomUUID() can fail there.

We do use crypto.randomUUID() in some frontend form flows for temporary client-side IDs. Since those IDs are not intended to be security-sensitive, we’re going to discuss whether Unleash should use a resilient UUID/local-ID helper instead of depending directly on that browser API.

In the meantime, HTTPS or a browser-trusted local origin would avoid the issue, but we understand that changing your local domain setup may not be desirable. Could you share your Unleash version, browser/version, exact console error, and the UI action where this fails?

[Der-Alex]

Thanks for the reply. I am currently using the browser-trusted local origin, wich works well. Nevertheless I thought this is something to discuss.

I am using Unleash Open Source 7.6.3, Chromium 147.0.7727.137 on Linux.

Console error:

TypeError: crypto.randomUUID is not a function
    at MP (index-C0tV9tYB.js:322:4842)
    at RE (index-C0tV9tYB.js:39:17031)
    at yY (index-C0tV9tYB.js:41:44104)
    at hY (index-C0tV9tYB.js:41:39822)
    at Lde (index-C0tV9tYB.js:41:39748)
    at x4 (index-C0tV9tYB.js:41:39598)
    at ww (index-C0tV9tYB.js:41:35960)
    at p$ (index-C0tV9tYB.js:41:36765)
    at Op (index-C0tV9tYB.js:39:3288)
    at index-C0tV9tYB.js:41:34286

The UI action is creating a new flag via button:

[gastonfournier]

Thanks! We've opened #12040 that will likely solve your problem.