src/app/hooks/useClientConfig.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest';
-import { clientDefaultServer } from './useClientConfig';
+import { ClientConfig, clientDefaultServer } from './useClientConfig';
 import config from '../../../config.json';
 
 describe('default homeserver', () => {
@@ -15,6 +15,6 @@ describe('default homeserver', () => {
   });
 
   it('is gamecult.org in the repo config.json too', () => {
-    expect(clientDefaultServer(config)).toBe('gamecult.org');
+    expect(clientDefaultServer(config as ClientConfig)).toBe('gamecult.org');
   });
 });

src/app/pages/auth/registrationEntry.test.ts

@@ -1,5 +1,6 @@
 import { describe, expect, it } from 'vitest';
 import { registrationEntry } from './registrationEntry';
+import type { ClientConfig } from '../../hooks/useClientConfig';
 import {
   PREVIEW_NOTICE_TEXT,
   TRAINING_NOTICE_TEXT,
@@ -17,7 +18,7 @@ describe('registration entry', () => {
   });
 
   it('ships off in config.json', () => {
-    expect(registrationEntry(config)).toBeUndefined();
+    expect(registrationEntry(config as ClientConfig)).toBeUndefined();
     expect(config.registration.enabled).toBe(false);
   });
 
@@ -44,4 +45,13 @@ describe('registration entry', () => {
     const entry = registrationEntry({ previewDemo: true, registration: { enabled: true, url } });
     expect(entry?.notice).toBe(PREVIEW_NOTICE_TEXT);
   });
+
+  it('accepts http only for a local development host', () => {
+    const on = (u: string) => registrationEntry({ registration: { enabled: true, url: u } });
+    expect(on('http://localhost:8080/register')?.url).toBe('http://localhost:8080/register');
+    expect(on('http://127.0.0.1:8080/register')).toBeDefined();
+    expect(on('http://accounts.example/register')).toBeUndefined();
+    expect(on('http://localhost.evil.example/register')).toBeUndefined();
+    expect(on('https://accounts.example/register')).toBeDefined();
+  });
 });

src/app/pages/auth/registrationEntry.ts

@@ -3,17 +3,24 @@ import { TRAINING_NOTICE_VERSION, trainingNoticeText } from '../../utils/trainin
 
 export type RegistrationEntry = { url: string; notice: string; noticeVersion: number };
 
+// Plain http is for a developer's own machine only; a stranger's sign-up page is https.
+const isLocalHost = (hostname: string): boolean =>
+  hostname === 'localhost' ||
+  hostname.endsWith('.localhost') ||
+  hostname === '127.0.0.1' ||
+  hostname === '[::1]';
+
 /**
  * The sign-up entry the sign-in page may show: the account service's registration page, when the
- * switch is on and the configured url is a plain http(s) address. Anything else is no entry. The
+ * switch is on and the configured url is an https address (http only for localhost). Anything else is no entry. The
  * consent sentence and its version are trainingNotice.ts's, the ones a room shows.
  */
 export const registrationEntry = (config: ClientConfig): RegistrationEntry | undefined => {
   const { enabled, url } = config.registration ?? {};
   if (enabled !== true || typeof url !== 'string') return undefined;
   try {
-    const { protocol } = new URL(url);
-    if (protocol !== 'https:' && protocol !== 'http:') return undefined;
+    const { protocol, hostname } = new URL(url);
+    if (protocol !== 'https:' && !(protocol === 'http:' && isLocalHost(hostname))) return undefined;
   } catch {
     return undefined;
   }