Quasar devServer HTTPS and Vite proxy HTTPS certificate validation
0 reputation · 14 Dec 2023, 22:23 UTC
Quasar CLI v2+ uses Vite as the dev server. HTTPS is configured via devServer.https in quasar.config.js as a boolean for auto-generated self-signed certs or an object with key/cert/ca paths. devServer.proxy forwards API requests to backend services.
Certificate validation for proxied HTTPS requests is performed by Node.js using its built-in trust store. Quasar does not provide a built-in mechanism to automatically trust project-local CAs for proxied requests. The effective trust model differs across deployment targets: SPA/PWA/SSR run in Node.js during development, while Capacitor/Cordova mobile apps and Electron builds use platform-specific web views with separate certificate trust requirements.
The design uncertainty is how certificate trust should be expressed for both the dev server TLS and the proxy agent, and whether it can be kept consistent across targets without relying on external process configuration.
Does Quasar CLI currently propagate a custom CA from devServer.https.ca to the proxy httpsAgent used by Vite? Is there a plan to expose a first-class devServer.ca option that applies to both dev server TLS and proxy agent across SPA, SSR, Capacitor and Electron targets? What is the intended approach for maintaining consistent certificate validation between the Vite dev server and proxied backends during development?