search

monarch-initiative / monarch-legacy

Monarch web application and API
BSD 3-Clause "New" or "Revised" License
42 stars 37 forks source link

Add SSL certificate to GOlr and SciGraph servers #1051

Closed hambone06 closed 8 years ago

hambone06 commented 9 years ago

When I visit the site http://monarchinitiative.org using Google Chrome the graphs never load on the browse pages.

cmungall commented 9 years ago

Thanks for reporting this. I'm not able to reproduce - can you give the URL of the page you're looking at (and also the version of Chrome).

Many thanks!

jmcmurry commented 9 years ago

also, if you could a) send a screenshot of what you do see, and b) let us know whether this is also the case on beta.monarchinitiative.org, that would be great.

Thanks

hambone06 commented 9 years ago

Hi again,

I am using google chrome Version 46.0.2490.80 (64-bit) and I have trouble loading the graphs on all of the "browse" pages for example https://monarchinitiative.org/phenotype and https://monarchinitiative.org/gene. I attached screenshots of these two urls as well. The good news is that the graphs do load on beta.monarchinitiative.org.

Let me know if there is anything else you want me to look into.

Will

On Fri, Oct 30, 2015 at 5:49 PM, Julie McMurry notifications@github.com wrote:

also, if you could a) send a screenshot of what you do see, and b) let us know whether this is also the case on beta.monarchinitiative.org, that would be great.

Thanks

— Reply to this email directly or view it on GitHub https://github.com/monarch-initiative/monarch-app/issues/1051#issuecomment-152658961 .

jmcmurry commented 9 years ago

Thanks Will, glad to hear that on beta it is behaving. These fixes will be released to production soon. cc: @kshefchek

kshefchek commented 9 years ago

I've tested in a few chrome versions and operating systems and cannot replicate. @hambone06 when you noticed the different behavior between beta and production, were you using the same network connection? It's possible a firewall could block the ajax calls that power the graph.

hambone06 commented 9 years ago

Hi Kent,

I don't think there was a change in the network connection. I tested the two instances back to back in the same window. I have been able to replicate the issue on three computers so far two macbooks and a pc. However, the issue is definitely caused by a pop-up blocker. If I unblock the script in one of the macbooks and the pc the graphs loads for https://monarchinitiative.org/disease and https://monarchinitiative.org/gene (I haven't gotten to the bottom of why that didn't fix the problem in the other mac). All three use Google Chrome Version 46.0.2490.80 (64-bit), and they are able to load the graphs when using Firefox from https://monarchinitiative.org and on the beta in Chrome without getting blocked.

Will

On Mon, Nov 2, 2015 at 4:35 PM, Kent Shefchek notifications@github.com wrote:

I've tested in a few chrome versions and operating systems and cannot replicate. @hambone06 https://github.com/hambone06 when you noticed the different behavior between beta and production, were you using the same network connection? It's possible a firewall could block the ajax calls that power the graph.

— Reply to this email directly or view it on GitHub https://github.com/monarch-initiative/monarch-app/issues/1051#issuecomment-153164481 .

kltm commented 9 years ago

It may be of some interest, we've had all kinds of fun with various safety plugins. A quick search from recent days gives:

https://github.com/geneontology/noctua/issues/201 https://github.com/geneontology/noctua/issues/190

If it does turn out like these, you have to be very very careful so as not to trigger all kinds of identity and XSS blocks--it turns out that a complicated webapp acts a lot like malware from the perspective of a third-party.

kshefchek commented 9 years ago

I just noticed the https versus http and now can replicate the problem. It seems to be an issue with loading the page with https and then calling services over http to generate the graph.

kltm commented 9 years ago

Yes, that's disallowed in a lot of browser/configurations now. Sigh.

kshefchek commented 9 years ago

@kltm so essentially we need our golr and scigraph servers to have https certs?

kltm commented 9 years ago

Possibly, but I haven't looked at this for your case. That's actually not so hard to do even if--for the GO setup, they just put an https proxy in front and it worked a treat.

kshefchek commented 9 years ago

Note that when connecting to the production site via https many client side widgets do not work (phenogrid, data/golr tables).

kltm commented 9 years ago

Yeah:

Blocked loading mixed active content "http://monarchinitiative.org/simsearch/phenotype"

from phenogrid-bundle.js.

That's the typical http/https issue.

https://developer.mozilla.org/en-US/docs/Security/MixedContent/How_to_fix_website_with_mixed_content

With http(s), you either have to be all in or all out these days. Welcome to the new normal, if https is required, it's time to cert up. If you can hold on a bit, maybe: https://letsencrypt.org/

harryhoch commented 9 years ago

@kshefchek , @kltm, didn't we go through some of this discussion earlier? I thought we had had phenogrid working over https...

yuanzhou commented 9 years ago

I just updated my chrome to Version 46.0.2490.80 m and I did reproduce the reported issue if I use https://. No issue with http://

capture

capture

kshefchek commented 9 years ago

@harryhoch Phenogrid should be easy to fix, you just want to call https://monarchinitiative.org/simsearch/phenotype rather than http://monarchinitiative.org/simsearch/phenotype cc @yuanzhou

jmcmurry commented 9 years ago

Thanks Zhou, this is useful. On a related note, what do you use for your screenshot markup? Can anyone recommend something? I am not up on the current offerings. Skitch?

yuanzhou commented 9 years ago

@jmcmurry On windows I use the default/builtin Snipping tool.

On mac, you can use

capture

kltm commented 9 years ago

The browsers and ad-blockers are getting more aggressive (for the Good of All), but that means more headaches for what these types of apps would like to do. Breakages are expected now and then, even if something worked before (assuming no code/arch regression).

The most obvious way forward is either http-for-http/https-for-https or all https. It's probably easiest from the developers point of view (as everybody probably does not want to deal with certs when developing locally) to tie it all away above the application level, like with proxy servers.

jmcmurry commented 9 years ago

Hi Zhou, Thanks, but sorry to have been vague. I do screenshots all the time; I just noticed you had used what looked like a pen on top of the screenshot and wondered whether you had a good tool for that kind of additional annotation feature?

yuanzhou commented 9 years ago

@jmcmurry I was just using Windows PC's snapping tool, very handy with the anotation pen. When I use my mac at home, I miss this tool. I'll let you know if I find any similar tool for Mac.

jmcmurry commented 8 years ago

@kshefchek says we can close this