Formhub own's URL protocol is hardcoded to http, causing issues with Enketo and insecure transport when secure is expected.

[MartijnR]

I ran across this question a few times. If formhub is hosted on https only, the server_url parameter sent to enketo's API should be:

https://myformub.com/account (https)

By default, it seems formhub continues to send the http server_url when hosted on https:

http://myformhub.com/account (http)

The 2 issues this causes are:

1. If the formhub service is not available on http, Enketo cannot retrieve the XForm (nor submit records)
2. Transport between the Enketo server and the Formhub server is unencrypted

Could somebody point me to the setting where this can be changed please?

[MartijnR]

This appears to be where Enketo API calls are made. If I understand this correctly, the form_url (i.e. the account url) parameter is hardcoded to http below:

• https://github.com/SEL-Columbia/formhub/blob/04cf4294811f82fe863c4b078b7b6a136ffc1e88/odk_logger/views.py#L436
• https://github.com/SEL-Columbia/formhub/blob/869e0a5285bd326907a20a8e22fc9cb6ba71a6a4/main/views.py#L1274

[MartijnR]

Can we do something like this (psuedo code) perhaps?

if request.is_secure() 
       protocol = 'https' 
else 
       protocol = 'http' 

and then build the formhub_url from that?

[ukanga]

I think that is ideal, it could be done this way.

[MartijnR]

thanks @ukanga

On Sun, Jun 15, 2014 at 3:17 AM, ukanga notifications@github.com wrote:

I think that is ideal, it could be done this way.

— Reply to this email directly or view it on GitHub https://github.com/SEL-Columbia/formhub/issues/1331#issuecomment-46110898 .

Did you know that Enketo Smart Paper has now become the #1 tool for data collection? Don't fall behind. Use it!

Enketo https://enketo.org | LinkedIn http://www.linkedin.com/company/enketo-llc | GitHub https://github.com/MartijnR | Twitter https://twitter.com/enketo

[dpapathanasiou]

I addressed this differently in this commit https://github.com/SEL-Columbia/formhub/commit/f75360ba72e1f810214fb76056b70979bca49f2b (the slim_dedicated_server is going to be merged into master soon).

[MartijnR]

Whooohoooo! Yes!!! :+1:

[dpapathanasiou]

Ha, thanks.

One p.o.s. code block cleared, 76,786,778,965,786,672,346,786 to go...