SSL Problems - Did I Fix It?

[friskyfrankie]

Had issues logging in this morning. Would keep kicking me back to the "login" dialog window. Then "System Error" page and then slow response time. Seems a little better now but time will tell!!

[kishy]

The "system error" is a different and completely unrelated problem, which is annoying because users don't necessarily care about why something doesn't work, only that it doesn't work, and we have numerous causes of things not working to various extents at various times.

Unfortunately, it isn't clear to me that we can ever make that go away without moving the site to a new host, and that's a fairly intensive, many-ducks-in-a-row process to avoid extended downtime.

[friskyfrankie]

Does seem that lately, it is a "crap shoot" as to if the system will work correctly or not. I do not seem to remember this in the past so what has changed?

[sly]

Oddly my Chrome instance at work is now not letting me in. It won't even let me force https over http to try to get it to work.

[Mainemantom]

With my i phone, I can log in however I cannot see words when I am trying to post something.
With my laptop, Using Firefox or Firefox Developer Edition, I cannot log in at all.
I can only log in using Firefox private browsing mode.

[DerekTheGreat]

Been working reliably for me the past several days. Thank you, fellas.

[sly]

I think firefox is stricter about cookies on http vs https.

I can login on edge if I force the site to https instead of http. Same on Firefox. Chrome won't let me force it to https and keeps redirecting to http.

[sly]

I adjusted the domain redirects to default to https to see if stuff would work out of the box... and that seems to have fixed issues with Edge and Firefox. Hopefully that will sort Chrome as well since Edge uses the same base engine.

[kishy]

OK, so it sounds like the answer to my question is that I fixed it for some frequent users and broke it for other frequent users.

Sly has perhaps fixed it more...uh...fixily than I did for a broader group.

The test now is, can the handful of people on the Facebook group who say the site is broke and they can't get on it, now successfully get on?

I'm not all about user and post counts being higher just for the sake of being higher, but if we have community members who love the place and never figured out how to bypass the problems, we owe them an attempt at a fix, and I'm hoping we've achieved that.

[sly]

I think the true fix would be to get a legit ssl cert and run on https proper... but yeah... I think this should work now. All my chromium based linux boxes like it now. I haven't tried Chrome proper yet on windows. I go back to work on Tuesday and can test that then.

[kishy]

I think the true fix would be to get a legit ssl cert and run on https proper... but yeah... I think this should work now. All my chromium based linux boxes like it now. I haven't tried Chrome proper yet on windows. I go back to work on Tuesday and can test that then.

We have a cert (actually a bunch for subdomains too), and the site itself now is doing that - the problem is that somewhere in the content that is loading, there is content loading via explicit HTTP links (for example the donor tag images in your own sig). I think gadget tried to analyze that in one of our discussions behind the scenes (vs this one out in the open).

I am not sure what the implications are if someone posts embedded content with an explicit HTTP link, and that's the next thing to address, but as long as core "I navigate to URL and a page loads and I submit my user+pass and it lets me log in and post things" is working, that was the problem I was aiming for here.

Personally, I'm in favour of the internet as a whole dropping the pitchforks about HTTP when the content has nothing to do with security that I'd call impactful - such as embedding a JPG using an HTTP link - but that ship has sailed and the war on HTTP is well underway.

[sly]

True enough. As long as can log-in and post... all good in my book. I'll look at what Pete was doing with the donor tags and see if I can figure out a good way to clean that up.

[sly]

I manually fixed my signature... just added an s to make the links https since the src= requires http part to work. I tried using url without transport and it broke it. Looks like we may just need a search and replace function to replace all http://www.grandmarq... with https://www.grandmarq...

[gadget73]

looks like the issues I was having yesterday cleared up

as for the donor links I think those could be relative URL rather than full http:// whatever stuff since they live on a folder on the server. Would just be annoying to go through and manually edit every single one.

[sly]

Even if you enter a relative one, it puts the https://www.grandmarq.net in front of it. Apparently it's part of the json in the BBcode that adds all of that.

Also, just noticed that the site says secure on the home page. Verified by cPanel, Inc.
Yeah... people shouldn't have any problems logging in now. They just may not see the insecure items (pictures in posts/signatures) if they don't allow insecure items. That's about it.