Deno desktop stuff

client/handshake.ts

@@ -25,12 +25,11 @@ export function default_server(page = new URL(location.href)): string {
 	return page.searchParams.get("server") ?? page.host;
 }
 
-// what a player typed as the server: host:port, or a full http(s) or ws(s) url
+// what a player typed as the server: host:port, or a full http(s) or ws(s) url to pick the scheme
 export function server_address(input: string, page = new URL(location.href)): ServerAddress {
 	const text = input.trim();
 	let host = text;
-	// without a scheme it's as secure as the page, browsers block insecure sockets from secure pages anyway
-	let secure = page.protocol === "https:";
+	let secure: boolean;
 	if (text.includes("://")) {
 		let url: URL;
 		try {
@@ -40,6 +39,10 @@ export function server_address(input: string, page = new URL(location.href)): Se
 		}
 		host = url.host;
 		secure = url.protocol === "https:" || url.protocol === "wss:";
+	} else {
+		// servers on this machine are plain ws and everything else is wss, whatever the page was served over. the
+		// desktop app's page is plain http on localhost, but the servers it joins are real domains behind tls
+		secure = !is_local_host(host);
 	}
 	if (!host || /[\s/?#]/.test(host)) {
 		throw new HandshakeError(`${text || "An empty address"} isn't a server address`);
@@ -52,6 +55,19 @@ export function server_address(input: string, page = new URL(location.href)): Se
 	};
 }
 
+const LOCAL_HOSTS = ["localhost", "127.0.0.1", "[::1]", "0.0.0.0"];
+
+// host is host:port, or just a host
+function is_local_host(host: string) {
+	let hostname: string;
+	try {
+		hostname = new URL(`http://${host}/`).hostname;
+	} catch {
+		return false;
+	}
+	return LOCAL_HOSTS.includes(hostname);
+}
+
 // a socket whose messages all land in one queue, so none get lost between the handshake and the game
 export class ServerSocket {
 	socket: WebSocket;