search

opengeospatial / geoapi

GeoAPI provides a set of interfaces in programming languages (currently Java and Python) for geospatial applications. The GeoAPI interfaces closely follow OGC specifications, adaptated to match the expectations of programmers.
http://www.geoapi.org
Apache License 2.0
118 stars 37 forks source link

Add SSL support to www.geoapi.org #52

Closed kinow closed 1 year ago

kinow commented 4 years ago

GitHub pages support HTTPS out of the box.

www.geoapi.org is what in GitHub Pages is called "custom domain" (opposite of something like geoapi.github.io). In the past, custom domain GitHub Pages had several limitations.

Nowadays most features are supported for both.

For www.geoapi.org, I believe we just need to follow this blog: https://github.blog/2018-05-01-github-pages-custom-domains-https/

I used it for my personal site which is also a custom domain GitHub Page, with SSL enabled. Props to GitHub and Let's Encrypt for providing such great service.

kinow commented 4 years ago

I like the option to enforce HTTPS so users are redirected to HTTPS by default, but that's not really important for geoapi I think, except that browsers/search crawlers give some bonus points if you do (as well as some privacy-concerned users).

The last paragraph in the post mentions their CDN. While it is good for DDOS, I can confirm my browsing is positively impacted by this, as the latency to New Zealand from some servers in US/Europe/etc can vary a lot. I think most CDN's have an Australasia zone.

kinow commented 4 years ago

Just checked and Firefox still unhappy with https://geoapi.org even after the DNS migration. I believe we can use either LetsEncrypt and/or a CDN for SSL. Though it would require a quick change in the DNS too if I remember correctly?

image

desruisseaux commented 1 year ago

I do not know how to fix "geoapi.org", but the root issue was that "geoapi.org" (without "www." prefix) should not be referenced at all. The URL should be "www.geoapi.org". But Google was referencing "geoapi.org" because of a small error in the _config.yml file on gh-pages branch. That file was declaring:

url: "https://geoapi.org"     # the base hostname & protocol for your site, e.g. http://example.com

which caused that URL to be declared in HTML headers and elsewhere. After fixing above URL, Google is now referencing https://www.geoapi.org as expected. Consequently the security warning with "geoapi.org" should be less important now. So I close this issue as "fixed" because it works for "www.geoapi.org" and because "geoapi.org" should not be referenced anymore.