It seems like since the forms server process controls both the browser and server, it should be able to generate certs on the fly so that the browser trusts the servers authenticity and the server refuses to serve anyone but the browser. Probably need to carve a debugging hole for curl and friends or something. Could even have a global variable that configures in the server and need to enable http traffic via lldb or something by setting the variable
It seems like since the forms server process controls both the browser and server, it should be able to generate certs on the fly so that the browser trusts the servers authenticity and the server refuses to serve anyone but the browser. Probably need to carve a debugging hole for curl and friends or something. Could even have a global variable that configures in the server and need to enable http traffic via lldb or something by setting the variable