search

smart-facility / petajakarta-web

Web files for PetaJakarta.org
http://petajakarta.org
Other
8 stars 6 forks source link

mixed content #77

Open matthewberryman opened 8 years ago

matthewberryman commented 8 years ago

The web site loads content from detik and qlue over http connections. Luckily it's just passive content (images, etc.) so (as far as I know and have tested) it just changes the padlock sign, it doesn't prevent the https version of the site from loading, nor does it show a browser warning popup. We should investigate if detik and qlue offer https and adjust the url accordingly. We may need to change the reports module too.

matthewberryman commented 8 years ago

@talltom: I have got a temporary fix for Qlue in https://github.com/smart-facility/petajakarta-web/commit/4a5b3eef15a9e9c104c24a2ac80e93adf44b0ff9 and if you're happy a proposed permanent fix in https://github.com/smart-facility/cognicity-reports-qlue/commit/2bf26248b9983d6dea141eee6d43ddb9bb36f4e9; fixed deeper in the stack = pushes the CPU load as a one off event to the reports module rather than as a continuing (but very tiny) CPU load across loading of Qlue reports on all web clients. Maybe you have some reason for keeping this in the client side code, however. There is an associated pull request https://github.com/smart-facility/cognicity-reports-qlue/pull/3 to merge into cognicity-reports-qlue if you're happy. Note that you can't deploy a git reversion of https://github.com/smart-facility/petajakarta-web/commit/4a5b3eef15a9e9c104c24a2ac80e93adf44b0ff9 and https://github.com/smart-facility/petajakarta-web/commit/2cfc54401fe2a568a853919e11ade7945a705098 until a period of time (defined by config.api.time_window in cognicity-server) after you deploy the reports change.

matthewberryman commented 8 years ago

@talltom Floodgauges aren't an issue as, although you pull the details of these over http in cognicity-reports-floodgauge (combined with live config file), they are rendered entirely in our server and with relative urls to image assets on our server, hence they come over https

matthewberryman commented 8 years ago

@talltom From memory, Detik is an issue as I couldn't see how to load these via http (their own site suffers from a similar issue). To be confirmed once I see a detik report on the map. You'd need to take this up with Detik.

tomasholderness commented 8 years ago

Qlue fix from @matthewberryman in https://github.com/smart-facility/cognicity-reports-qlue/pull/3