http-api: authenticate doesn't enforce insecure connections
Instead of forcing people to connect over http://, fall back gracefully to http if no protocol is given.
This fixes an issue where external clients can't use this method, since SameSite cookies need to be secure as per
@@ -144,7 +144,7 @@ export class Urbit {
code,
verbose = false,
}: AuthenticationInterface) {
- const airlock = new Urbit(`http://${url}`, code);
+ const airlock = new Urbit(url.startsWith('http') ? url : `http://${url}, code);
airlock.verbose = verbose;
airlock.ship = ship;
await airlock.connect();
