Local callback to 127.0.0.1 after approval fails in Safari if "warn before connecting to a website over HTTP" is enabled. #538

Lukas-UAUX commented 2025年09月11日 14:00:24 +02:00

Hi, after we got a message from one of our members that he can not login into eduVPN on macOS we found out that the setting "warn before connecting to a website over HTTP" in Safari blocks the calback back to the eduVPN app after the approval.

Probably unintentional because as the name implies it should only warn and not block it but alas it still does. As I don't think the user enabled this option himself maybe is apple testing some new defaults?

Just noting it here in case someone other stumbles across the same problem...

Hi, after we got a message from one of our members that he can not login into eduVPN on macOS we found out that the setting "warn before connecting to a website over HTTP" in Safari blocks the calback back to the eduVPN app after the approval. Probably unintentional because as the name implies it should only warn and not block it but alas it still does. As I don't think the user enabled this option himself maybe is apple testing some new defaults? Just noting it here in case someone other stumbles across the same problem...

fkooman commented 2025年09月11日 14:09:02 +02:00

Thanks for the heads-up! I did hear about this issue before some (削除) years (削除ここまで) months ago, seems like a (long standing) Apple bug in that case. Obviously localhost should be excluded from their warning/block.

Thanks for the heads-up! I did hear about this issue before some ~years~ months ago, seems like a (long standing) Apple bug in that case. Obviously `localhost` should be excluded from their warning/block.

jwijenbergh commented 2025年09月11日 14:10:23 +02:00

We have seen this before in January. This is actually two bugs in safari I guess. localhost should be excluded and in practice it's not a warning but it completely fails to load

We have seen this before in January. This is actually *two* bugs in safari I guess. `localhost` should be excluded and in practice it's not a warning but it completely fails to load

jwijenbergh commented 2025年09月11日 14:33:11 +02:00

in my testing, lockdown mode doesn't influence this setting

in my testing, lockdown mode doesn't influence this setting

Lukas-UAUX commented 2025年09月11日 14:44:31 +02:00

what lockdown mode?

what lockdown mode?

jwijenbergh commented 2025年09月11日 15:00:15 +02:00

Here: image

Here: 

Lukas-UAUX commented 2025年09月12日 00:49:18 +02:00

Ah okay never heard of it - just to be sure that this isn't a mixup - I meant the setting in Safari itself.

Ah okay never heard of it - just to be sure that this isn't a mixup - I meant the setting in Safari itself.

jwijenbergh commented 2025年09月12日 11:13:35 +02:00

@Lukas-UAUX wrote in #538 (comment):

Ah okay never heard of it - just to be sure that this isn't a mixup - I meant the setting in Safari itself.

Not a mixup, was just testing if lockdown mode influences that setting. Because for me it was off (the setting in safari) by default

@Lukas-UAUX wrote in https://codeberg.org/eduVPN/apple/issues/538#issuecomment-7120468: > Ah okay never heard of it - just to be sure that this isn't a mixup - I meant the setting in Safari itself. Not a mixup, was just testing if lockdown mode influences that setting. Because for me it was off (the setting in safari) by default

roopc commented 2025年12月11日 09:47:30 +01:00

We'll be adopting ASWebAuthenticationSession in the near future (#555), and there we will not be using the localhost server then. Will close this issue once we have a release with that change.

We'll be adopting ASWebAuthenticationSession in the near future (#555), and there we will not be using the localhost server then. Will close this issue once we have a release with that change.

jwijenbergh commented 2025年12月17日 10:08:02 +01:00

This can be closed and we can track this in #555?

This can be closed and we can track this in #555?

roopc commented 2026年03月19日 12:30:45 +01:00

We no longer connect to 127.0.0.1 after #555.

We no longer connect to 127.0.0.1 after #555.