Open nekr0z opened 5 years ago
What's your default url? token is generated across site secret, time and session id, and I believe switching between http and https will cause the session id to be regenerated owing to the secure flag on the session token.
So, if your domain is configured as https but you're trying to log in from http (but the form target is the https endpoint) you're likely not going to get anywhere
What's your default url?
I'm really not sure these days. Looks like https is my default (well, at least it works, doesn't it?), but I see the browser always complaining that pictures get served via http despite the page being https, so maybe it's http by default after all. How do I really check?
I don't really mind logging in using https only (it's supposed to be more secure that way after all), but today I bumped into a site that was trying to get me to IndieAuth via http, and I couldn't log in, hence the issue here.
I really hope that one of these days Known allows me to make it https for everything, including redirecting http request to https like the big boys do all over the web, but I got to understand @benwerd had some valid points against it, and fixing all legacy posts would require a major database overhaul, so I'm not counting on it that much either. But seeing as how for now Known allows both http and https and doesn't seem to mind either way, I thought it would be reasonable to expect login being possible both ways.
While trying to do this:
Log in into my known instance via http.
I encountered this error:
Some other notes:
If I try the same with https (same password, same everything), it works.
Give us some context:
It'd also be really handy if you could tell us the contents of your
version.known
fileWhat database are you using? (e.g. mongo, mysql, postgres) MySQL
Any warnings or errors in your admin/diagnostics page? No. But here are server logs:
If this is a programming bug, can you include examples of any Micropub / API calls / webhook pings you make? Otherwise please don't worry about what this means!
Bonus points - are you able to illustrate the issue with a unit test? If so, submit it as a pull request!