Nov 16, 2022 evan's Blog

HTTPS Support for App Inventor

In the coming weeks, we will be rolling out HTTPS support for MIT App Inventor. This is an important update to improve the security of the many app inventors around the world, but it requires that people are running the latest software.

How will this affect me?

• Anyone using Companion version 2.63 or earlier must update to 2.64 or later.
• If you use the Android companion without checking the “Use Legacy Connection,” everything will continue to work as it does today.
• If you use the iOS companion, or the Android companion with the “Use Legacy Connection” box checked, then you will see a popup appear in your browser when connecting. This is used to help facilitate the legacy connection mode when using HTTPS.
• If you use the emulator or USB, you will need to potentially update your setup tools package to 30.265.0 or later. This is currently available for Windows and macOS packages are forthcoming.

Why is this change happening?

For more details, read Jeff Schiller’s earlier post on security in MIT App Inventor. However, the main gist is that older versions of App Inventor for Android, as well as the iOS version, relied primarily on using HTTP for the editor and companion to communicate. Browsers block this behavior when a website is served over HTTPS to prevent leaking information over insecure channels.

However, Google Chrome and related browsers (e.g., Microsoft Edge) are going to start enforcing new rules about the types of inter-device communication that App Inventor has relied on to work. These new rules will prevent App Inventor from working, except in situations where the website is served over HTTPS and the companion app responds with the correct metadata to authorize the connection. We have been busy updating the companions and emulator packages to ensure that they meet the new requirements. The last step in this process is updating App Inventor to be served over HTTPS, which we will be rolling out over the next month.

How will this affect me?

Generally, this change will increase the security of App Inventor for all of our users. Most users will be unaffected since they’re already using the latest version of App Inventor for Android and iOS. You may be prompted about updating your companion or emulator package if App Inventor detects that you’re using a version that is too old to be compatible with these security changes. Make sure you are running companion version 2.64 or later, or using aiStarter version 30.265.0 or later.

Next steps

If you haven’t already, install the latest companion app from the Apple App Store or Google Play Store. You can also download the Android companion for side-loading using the following QR code:

App Store	Play Store	Direct Download APK for Android

If you use the emulator or USB connection, please install the latest version for Windows here. An update for macOS is in the works.