#119 Default to SSL

None
closed
nobody
security (2) platform (1)
2014-03-05
2014-02-10
Alfredo Matos
No
0 up votes | 0 down votes | 0%
5 comments

With new and validated certificates, the platform should default to https://opensourceprojects.eu/ instead of http://opensourceprojects.eu/

Related

Ticket: #111
Ticket: #104
Ticket: #122

Discussion

  • Rui Ferreira
    Rui Ferreira
    2014-02-10

    Should we? Currently the following links in the platform use SSL

    1. login/logout actions
    2. repository clone URLs

    A side effect of (1.) is that all users end up using SSL after they login. I have added https: as the default scheme for Allura but I am not enforcing it at this moment (i.e. HTTP redirect).

     
    Link

  • Alfredo Matos
    Alfredo Matos
    2014-02-10

    Revisiting the website after auth or following any of the email links never gets me to https, as most links are provided in http.

    We should simply just redirect everything. Any reason not to?

     
    Link

  • Rui Ferreira
    Rui Ferreira
    2014-02-11

    Hi,

    SSL enabled by default for the entire site! Please provide some feedback, in particular with less obvious parts like

    • Repositories
    • Generated links to content (e.g. notication mails)
    • AOB
     
    Link

  • Rui Ferreira
    Rui Ferreira
    2014-02-26

    • status: open --> accepted
     
    Link

  • Rui Ferreira
    Rui Ferreira
    2014-03-05

    Ok, this has been up for a while now, closing the issue.

     
    Link

  • Rui Ferreira
    Rui Ferreira
    2014-03-05

    • status: accepted --> closed
     
    Link