From 87ba1e4298015d34695eea3d7ecebc078c839c8f Mon Sep 17 00:00:00 2001
From: AJ ONeal <aj@daplie.com>
Date: Mon, 8 May 2017 16:18:49 -0600
Subject: [PATCH] warn browser users loud and clear that only https is
 supported

---
 oauth3.core.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/oauth3.core.js b/oauth3.core.js
index 806b4b6..f71487d 100644
--- a/oauth3.core.js
+++ b/oauth3.core.js
@@ -2,6 +2,10 @@
 ;(function (exports) {
   'use strict';
 
+  if ('undefined' !== typeof window && 'https:' !== window.location.protocol) {
+    window.alert("You must use https. We suggest using caddy as your webserver (or serve-https if testing locally)");
+  }
+
   var OAUTH3 = exports.OAUTH3 = {
     clientUri: function (location) {
       return OAUTH3.uri.normalize(location.host + (location.pathname || ''));