search

vermiculus / sx.el

Stack Exchange for Emacs
http://stackapps.com/q/3950
709 stars 40 forks source link

Why does authentication send my token to an HTTP site? (seanallred) #314

Closed Hunter-Github closed 6 years ago

Hunter-Github commented 8 years ago

Can't understand the process. Does that mean access to my account is shared by a dozen other folks?

vermiculus commented 8 years ago

No, your account is not shared with anyone.

Hunter-Github commented 8 years ago

Why an insecure redirect, then?

Hunter-Github commented 8 years ago

I must be missing something obvious, please bear with me. If you have an RTFM link handy, that'll do.

vermiculus commented 8 years ago

The authentication is handled entirely by StackExchange.

image

As you can see, I don't provide the protocol -- just the domain.

Hunter-Github commented 8 years ago

Ah ok, thanks.

vermiculus commented 8 years ago

Hmm, actually it's defined by a variable here:

https://github.com/vermiculus/sx.el/blob/4892f45746fb217d059f4fa074a237c5bac7dd6c/sx-auth.el#L37

vermiculus commented 8 years ago

Can you change the value of that constant to use https and see if it still works for you? If it does, I'll change in master.

Hunter-Github commented 8 years ago

Changed, the redirect URI has changed but since the seanallred.com listens only on HTTP, it did not pull the page.

vermiculus commented 8 years ago

That's something with GitHub pages that I cannot fix, then. :frowning:

vermiculus commented 8 years ago

Well.... maybe. I'll have to screw around with my domain settings later tonight, but I'll give it a shot.

Hunter-Github commented 8 years ago

Many thanks in advance. Don't sweat it, though, the app was recommended by Gilles but I can live without it.

Hunter-Github commented 8 years ago

Relevant Sec.SE answer: https://security.stackexchange.com/a/66138

vermiculus commented 8 years ago

For as long as I use GitHub Pages for my blog, this won't really be possible (until GitHub makes some changes with its SSL cert strategy).

Just so you're aware, only the authentication token is sent unsecurely.

  1. Unless you're on public wifi, I really wouldn't worry about it.
  2. You can revoke this authentication token at any time. It's not related to your password.

I'm going to leave this issue open in hopes that GitHub makes this possible or that my blog moves to another host. But for now, there's nothing I can do.

Malabarba commented 8 years ago

Yeah, I looked into it for my blog as well, but gh-pages just doesn't do https ATM.

Hunter-Github commented 8 years ago

Okay, thanks.

RockyRoad29 commented 6 years ago

I was not able to get an OAuth token M-x sx-authenticate sends me to uri (I obliterated here the client-id) https://stackoverflow.com/oauth/dialog?client_id=####&redirect_uri=http%253A%252F%252Fseanallred.com%252Fsx.el%252Fauth%252Fauth.htm&scope=read_inbox%2cno_expiry%2cprivate_info%2cwrite_access. The server answers: http%3A%2F%2Fseanallred.com%2Fsx.el%2Fauth%2Fauth.htm is not a valid uri

I tried adding setting by hand https in the redirect_uri, it doesn't help. As I couldn't figure out how removing the https from the request uri would be secure, It didn't try it.

But I think the redirect_uri looks like encoded twice.

vermiculus commented 6 years ago

But I think the redirect_uri looks like encoded twice.

You're right on the money there. This is unrelated to this issue, though; can you open a new one?

RockyRoad29 commented 6 years ago

Sure. See issue #349 and PR #350

vermiculus commented 6 years ago

GitHub Pages now supports HTTPS, so this has been addressed.