getCurrentPosition() and watchPosition() are deprecated on insecure origins

Question

I am getting this error on my website which requests Geolocation data from the user:

getCurrentPosition() and watchPosition() are deprecated on insecure origins, and support will be removed in the future. You should consider switching your application to a secure origin, such as HTTPS. See goo.gl/rStTGz for more details.

I mean its basically just a notice, and the google link just says its being deprecated.

I have no plans on moving my website to SSL... so is there an alternative for someone like me?

Lets hope their won't just shut the feature down without replacement in the future release... — Phung D. An, Oct 07 '15 at 18:58
They are likely to shut the feature down without replacement in a future release. That's exactly why they are deprecating it now. Quote *we expect to gradually migrate these features to secure-only* — MarkJ, Mar 16 '16 at 15:05

score 47 · Answer 1 · answered May 17 '16 at 12:34

47

Because switching to HTTPS can be painful or impossible depending on your architecture, I found a workaround solution: you can use the Google Maps Geolocation API. Although it has usage limits, it does the job. You will need an browser API key, so don't forget to limit it's usage to your page hostname.

I use it as a fallback method to the getCurrentPosition() method if it fails. It allows me to make it work until I switch to HTTPS.

Here's the JSFiddles:

HTTP: getCurrentPosition() will fail and fall back to the API
HTTPS: getCurrentPosition() will succeed

answered May 17 '16 at 12:34

gogson

930
2
8
11

Hi, can you post an example please? Thanks – Patrick May 18 '16 at 16:53
I am will still getting the warning message, that's ok? – Patrick May 19 '16 at 09:39
2

Yes because the fiddle only use the API when the browser geolocation fails (when you get the warning). – gogson May 19 '16 at 10:46
Thx @gogson for the tips ;) – Nicolas Le Bot Aug 13 '16 at 23:32
Thank you so much! – TechnoCorner Sep 25 '16 at 04:35
1

Note that the example uses JQuery. – handle May 01 '17 at 10:56
2

Also, the Google Maps Geolocation API does not mention GPS but rather network access points (wifi, cellular) or IP geo-info as fallback. So it seems HTTPS is essential now. – handle May 02 '17 at 07:00
Indeed, thanks for the precision. Soon we will all need to switch to HTTPS due to Chrome strict policy. The sooner, the better. – gogson May 05 '17 at 08:27

score 23 · Answer 2 · answered Nov 01 '19 at 19:22

23

It's only for test, you can do it in google chrome: navigate to: chrome://flags/#unsafely-treat-insecure-origin-as-secure then you'll see: Type address you want to allow, then enable and relaunch your browser.

answered Nov 01 '19 at 19:22

Archil Labadze

4,049
4
25
42

1

This should be marked as the correct answer. – obe Jan 09 '21 at 20:48
1

Works as a charm! – wajdi_jurry Mar 24 '21 at 14:26

score 21 · Accepted Answer · answered Aug 20 '15 at 17:37

Found a likely answer in /jstillwell's posts here: https://github.com/stefanocudini/leaflet-gps/issues/15 basically this feature will not be supported (in Chrome only?) in the future, but only for HTTP sites. HTTPS will still be ok, and there are no plans to create an equivalent replacement for HTTP use.

score 14 · Answer 4 · edited Jun 20 '20 at 09:12

Yes. Google Chrome has deprecated the feature in version 50. If you tried to use it in chrome the error is:

getCurrentPosition() and watchPosition() are deprecated on insecure origins. To use this feature, you should consider switching your application to a secure origin, such as HTTPS. See https://sites.google.com/a/chromium.org/dev/Home/chromium-security/deprecating-powerful-features-on-insecure-origins for more details.

So, you have to add SSL certificate. Well, that's the only way.

And it's quite easy now using Let's Encrypt. Here's guide

And for testing purpose you could try this:

1.localhost is treated as a secure origin over HTTP, so if you're able to run your server from localhost, you should be able to test the feature on that server.

2.You can run chrome with the --unsafely-treat-insecure-origin-as-secure="http://example.com" flag (replacing "example.com" with the origin you actually want to test), which will treat that origin as secure for this session. Note that you also need to include the --user-data-dir=/test/only/profile/dir to create a fresh testing profile for the flag to work.

I think Firefox also restricted user from accessing GeoLocation API requests from http. Here's the webkit changelog: https://trac.webkit.org/changeset/200686

I'm geeting info: "You are using an unsupported command-line flag: --unsafely-treat-insecure-origin-as-secure. Stability and security will suffer". Chrome version: 50.0.2661.102. Also gelocation still not working — instead, May 13 '16 at 19:03
Kill all instances and try again. http://stackoverflow.com/questions/6918393/the-disable-web-security-command-is-seems-no-longer-working — Asim K T, May 15 '16 at 10:02
When testing out your app in the chrome browser, just change the apps url (generally 192.xxx.xxx.xxx:3000) to localhost:3000 .. You will need to make sure your media policy supports it, but you will not get a security error. — MindWire, Mar 02 '17 at 23:54

Ben Dowling · Answer 5 · 2016-09-23T20:08:59.353

You could use the https://ipinfo.io API for this (it's my service). It's free for up to 1,000 req/day (with or without SSL support). It gives you coordinates, name and more. Here's an example:

curl ipinfo.io
{
  "ip": "172.56.39.47",
  "hostname": "No Hostname",
  "city": "Oakland",
  "region": "California",
  "country": "US",
  "loc": "37.7350,-122.2088",
  "org": "AS21928 T-Mobile USA, Inc.",
  "postal": "94621"
}

Here's an example which constructs a coords object with the API response that matches what you get from getCurrentPosition():

$.getJSON('https://ipinfo.io/geo', function(response) { 
    var loc = response.loc.split(',');
    var coords = {
        latitude: loc[0],
        longitude: loc[1]
    };
});

And here's a detailed example that shows how you can use it as a fallback for getCurrentPosition():

function do_something(coords) {
    // Do something with the coords here
}

navigator.geolocation.getCurrentPosition(function(position) { 
    do_something(position.coords);
    },
    function(failure) {
        $.getJSON('https://ipinfo.io/geo', function(response) { 
        var loc = response.loc.split(',');
        var coords = {
            latitude: loc[0],
            longitude: loc[1]
        };
        do_something(coords);
        });  
    };
});

See http://ipinfo.io/developers/replacing-navigator-geolocation-getcurrentposition for more details.

What antivirus do you have installed on your machine, or network? — Ben Dowling, Mar 07 '17 at 14:45

score 8 · Answer 6 · answered Jun 02 '16 at 11:09

8

You can run chrome with the --unsafely-treat-insecure-origin-as-secure="http://example.com" flag (replacing "example.com" with the origin you actually want to test), which will treat that origin as secure for this session. Note that you also need to include the --user-data-dir=/test/only/profile/dir to create a fresh testing profile for the flag to work.

For example if use Windows, Click Start and run.

chrome --unsafely-treat-insecure-origin-as-secure="http://localhost:8100"  --user-data-dir=C:\testprofile

answered Jun 02 '16 at 11:09

Injection

301
3
8

3

And how does one get users to do this? – Marty Kiker Jul 09 '16 at 03:02
On Mac: `/usr/bin/open -n "/Applications/Google Chrome.app" --args "http://localhost:8100" --unsafely-treat-insecure-origin-as-secure="http://localhost:8100" --user-data-dir=/tmp/testprofile` – Hugo Jan 16 '19 at 16:20

score 2 · Answer 7 · answered Jun 22 '19 at 18:35

2

For dev only, you can authorize specific local domains to use this features:

https://medium.com/@Carmichaelize/enabling-the-microphone-camera-in-chrome-for-local-unsecure-origins-9c90c3149339

answered Jun 22 '19 at 18:35

Paul

1,290
6
24
46

score 0 · Answer 8 · answered Jun 10 '16 at 09:10

0

In HTTP the error occurs.

Set permission for localhost in bellow label(Accept requests from these HTTP referrers (web sites)).

It worked for me.

answered Jun 10 '16 at 09:10

Md. Saidur Rahman Milon

2,761
23
29

score 0 · Answer 9 · answered Sep 14 '16 at 07:57

I know that the geoLocation API is better but for people whom can't use an SSL, you can still use some sort of services such as geopluginService.

as specified in the documentation you simply send a request with the ip to the service url http://www.geoplugin.net/php.gp?ip=xx.xx.xx.xx the output is a serialized array so you must need to unserialize it before using it.

Remember this service is not very accurate as the geoLocation is, but it is still an easy and fast solution.

score -1 · Answer 10 · answered Aug 29 '16 at 09:03

-1

Use FireFox or any other browser instead of Chrome if you want to test it on your development environment, for production there is no way except using https.

For development environment just open http://localhost:8100/ on FireFox and alas no such error.

answered Aug 29 '16 at 09:03

Edris

925
9
13

Firefox 64: "A Geolocation request can only be fulfilled in a secure context." – Hugo Jan 16 '19 at 16:12
Safari 12: "[blocked] Access to geolocation was blocked over insecure connection to http://0.0.0.0:8060." – Hugo Jan 16 '19 at 16:13
Opera 57: "[Deprecation] getCurrentPosition() and watchPosition() no longer work on insecure origins. To use this feature, you should consider switching your application to a secure origin, such as HTTPS." – Hugo Jan 16 '19 at 16:14

score -3 · Answer 11 · edited Jan 09 '18 at 07:36

-3

Give some time to install an SSL cert getCurrentPosition() and watchPosition() no longer work on insecure origins. To use this feature, you should consider switching your application to a secure origin, such as HTTPS.

edited Jan 09 '18 at 07:36

answered Sep 08 '16 at 03:23

Ryan

491
4
16

getCurrentPosition() and watchPosition() are deprecated on insecure origins

11 Answers11

Linked

Related