Re-submit causes do_the_halfnarp to fail

zecke commented

2016-11-18 22:05:35 +01:00

(Migrated from github.com)

Go to https://halfnarp.events.ccc.de and submit your selection
33C3-halfnarp-api http://halfnarp.events.ccc.de/-/talkpreferences/... will be saved to local storage
Re-submit (in Safari and most likely others too) will fail with something like

[blocked] The page at https://halfnarp.events.ccc.de/#.... was not allowed to display insecure content from http://halfnarp.events.ccc.de/-/talkpreferences/....

I don't know pyramid at all but self.request.route_url in the view is most likely returning the http:// url? Is X-Forwarded-Proto or something like that not set?

1. Go to https://halfnarp.events.ccc.de and submit your selection 2. 33C3-halfnarp-api http://halfnarp.events.ccc.de/-/talkpreferences/... will be saved to local storage 3. Re-submit (in Safari and most likely others too) will fail with something like ``` [blocked] The page at https://halfnarp.events.ccc.de/#.... was not allowed to display insecure content from http://halfnarp.events.ccc.de/-/talkpreferences/.... ``` I don't know pyramid at all but self.request.route_url in the view is most likely returning the http:// url? Is X-Forwarded-Proto or something like that not set?

erdgeist commented

2016-11-18 22:10:58 +01:00

(Migrated from github.com)

the halfnarp API is set by your browser, maybe you've been visiting the halfnarp via http before?

erdgeist commented

2016-11-18 22:17:45 +01:00

(Migrated from github.com)

Ahh, now I see what you mean. Will look into how to fix it client side, if it was stored with a http scheme in localStorage.

zecke commented

2016-11-18 22:21:43 +01:00

(Migrated from github.com)

Great, and I just finished getting a simple reproducer out of chrome. Request made through https and "public_url/update_url" returns a http:// url. Thanks for fixing it.

curl 'https://halfnarp.events.ccc.de/-/talkpreferences' -H 'Origin: https://halfnarp.events.ccc.de' -H 'Accept-Encoding: gzip, deflate, br' -H 'Accept-Language: en-US,en;q=0.8,de;q=0.6' -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.98 Safari/537.36' -H 'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H 'Accept: application/json, text/javascript, */*; q=0.01' -H 'Referer: https://halfnarp.events.ccc.de/' -H 'X-Requested-With: XMLHttpRequest' -H 'Connection: keep-alive' -H 'DNT: 1' --data '{"talk_ids":[]}' --compressed
{"public_url": "http://halfnarp.events.ccc.de/-/talkpreferences/public/41c1c8f1a1369808a0385584e484f53ad7749194d975411721409ee40ffa24de", "update_url": "http://halfnarp.events.ccc.de/-/talkpreferences/887bd66d610b48cbacc348724fb21928", "hashed_uid": "41c1c8f1a1369808a0385584e484f53ad7749194d975411721409ee40ffa24de", "uid": "887bd66d610b48cbacc348724fb21928"}

Great, and I just finished getting a simple reproducer out of chrome. Request made through https and "public_url/update_url" returns a http:// url. Thanks for fixing it. ``` curl 'https://halfnarp.events.ccc.de/-/talkpreferences' -H 'Origin: https://halfnarp.events.ccc.de' -H 'Accept-Encoding: gzip, deflate, br' -H 'Accept-Language: en-US,en;q=0.8,de;q=0.6' -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.98 Safari/537.36' -H 'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H 'Accept: application/json, text/javascript, */*; q=0.01' -H 'Referer: https://halfnarp.events.ccc.de/' -H 'X-Requested-With: XMLHttpRequest' -H 'Connection: keep-alive' -H 'DNT: 1' --data '{"talk_ids":[]}' --compressed {"public_url": "http://halfnarp.events.ccc.de/-/talkpreferences/public/41c1c8f1a1369808a0385584e484f53ad7749194d975411721409ee40ffa24de", "update_url": "http://halfnarp.events.ccc.de/-/talkpreferences/887bd66d610b48cbacc348724fb21928", "hashed_uid": "41c1c8f1a1369808a0385584e484f53ad7749194d975411721409ee40ffa24de", "uid": "887bd66d610b48cbacc348724fb21928"} ```

Rows
Columns

Re-submit causes do_the_halfnarp to fail #19