Access clipboard on "insecure" http url

[mavaa]

I'm only about 80% sure this is the issue I'm having, but I think that (probably for security reasons) sites loaded using http are not allowed to access my clipboard? I know you normally wouldn't do this, and this is partly due to me being lazy, but I have a couple of docker services running on a remote machine that servers some apps I use personally. The way I've set it up, the services only listen on an IP range that is set up against wireguard, so my reasoning has been that since Wireguard encrypts all the traffic, I don't bother with ssl certificates. So my question is, is there something in qutebrowser or qtwebengine that blocks this, and is there a setting I can use to change it, only for my wireguard IPs?

What I see when testing in web console is that the permissions API acutally reports that clipboard read and write is allowed. However, the window.navigator.clipboard object doesn't exist for the service I'm testing on.

And yes, I've tried setting the content.javascript.clipboard option, both globally, and domain specific. For domain, I only used the IP of the service, but maybe I have to include the protocol and/or port as well?

If not possible to fix any other way, I know how to set up a private domain and certificate through letsencrypt, I just haven't gotten around to it 😅

[mavaa]

As per this and this I tried setting qt.args to ["unsafely-trieat-insecure-origin-as-secure=http://myip"] in multiple configurations with and without protocol and port number, but without luck sadly.

I'm also about 100% certain this is my problem now, since window.isSecureContext returns false on my wireguard services. Will try a bit more, but then probably resign to just doing what I should and set up traefik to handle domains and SSL.

[The-Compiler]

You have a typo in there (trieat). But even with the correctly spelled version I can't seem to get it to work, at least from a quick test with qutebrowser --temp-basedir --qt-flag unsafely-treat-insecure-origin-as-secure=http://example.org http://example.org.

Having done a similar thing recently, I'd indeed recommend Traefik. Its docs about ACME / Let's Encrypt are pretty nice.

[mavaa]

Was pretty sure I just copy-pasted the flag from somewhere, but you are right, both in the typo, and that the correct version doesn't work for me either. I'll go the SSL route instead, since I this is probably too much of an edge case to bother doing anything about. Call it a security feature rather than an issue 🙂