Daily updates from Odoo
Thursday, June 25, 2020
1 change
Resolved issues and error corrections
IoT Boxes now connect through a short-lived manual pairing code instead of direct browser communication, avoiding issues caused by browsers blocking mixed content. This keeps customers able to register new IoT Boxes securely and reliably as browser security rules tighten.
Original PR description
In Chrome 84, mixed content will be completely blocked for security reasons ([see blog](https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html)) Other browsers will probably follow…
In Chrome 84, mixed content will be completely blocked for security reasons ([see blog](https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html)) Other browsers will probably follow in the next months. As IoT Boxes don't have a valid certificate before connecting to a DB, we used mixed passive content to communicate with the boxes. This won't be possible anymore, and we have no possible way to communicate directly from the browser to the box. - When an IoT Box boots without registered DB, a unique code will be created with a validity of 5 minutes. - This code will be shown on the customer display and printed on the status ticket. - The box will call a route on odoo.com and a record will be created in odoo.com with the unique code. - The user will have to enter the code manually in his DB to connect to the IoT Box, the DB will then contact odoo.com to search for a record containing the unique code. If it's found, the `openerp.enterprise.database` will be added to the record. - The box will then query odoo.com at regular intervals (10 seconds) to check if a DB is linked to the code. Taskid: 2246535 X-original-commit: 05de66e6ea815e32b463f1e49e974d30fcf05ac4