HTTPS?

[bmah]

I wasn't able to find any query like this in the forums so far so...

Any chance of getting the forum to work over HTTPS instead of (or in addition to) plain HTTP? It sort of halfway works for the first page load, depending on browser settings, but then any click seems to go back to using HTTP.

One reason to do this is the when users login, at least some part of their credentials get passed in the clear over the network.

Thanks!

 

[doug]

I hear ya. I'd like us to switch to https exclusively, but vBulletin, our current forum software, does not make it easy. The problem is there are a lot of non SSL elements, e.g. externally hosted embedded images, etc. Most modern browsers will basically block the entire page when that happens.

We're looking to migrate platforms, which will get more attention after TMC Connect. Note that the event website does have SSL.

 

[bmah]

I hear ya. I'd like us to switch to https exclusively, but vBulletin, our current forum software, does not make it easy. The problem is there are a lot of non SSL elements, e.g. externally hosted embedded images, etc. Most modern browsers will basically block the entire page when that happens.

In a way it's comforting to know I'm not the only person who's thought about this.

We're looking to migrate platforms, which will get more attention after TMC Connect. Note that the event website does have SSL.

Cool, thanks!

Bruce.

 

[wk057]

Have you considered an SSL front end/load balancer that would do the SSL on the client side but leave the backend non-SSL? Not ideal if done incorrectly, but could be done with one of many services, like an AWS Elastic Load Balancer I believe. Can also get IPv6 support this way.

Isn't TMC on AWS now? Should be relatively straightforward to put the site behind an ELB and enable SSL on the client side of things. Would only be non-SSL internally at that point. I've done this previously, and it works reasonably well.

(I had this discussion recently and.... I can't remember if it was here or not....)

 

[bmah]

Bump. Just wondering what the current thinking is along these lines...

Thanks!

 

[doug]

We're not there yet, but hope to be there "soon."

 

[bridaus]

Please migrate to Discourse! Just voting if voting counts.

 

[doug]

Please migrate to Discourse! Just voting if voting counts.

Spent a lot of time evaluating Discourse. I like the ideas, but it's still not ready for primetime. Also I find with every little change people complain. If we went to a platform as different as Discourse, this place would implode.

 

[wk057]

Have you considered an SSL front end/load balancer that would do the SSL on the client side but leave the backend non-SSL? Not ideal if done incorrectly, but could be done with one of many services, like an AWS Elastic Load Balancer I believe. Can also get IPv6 support this way.

Isn't TMC on AWS now? Should be relatively straightforward to put the site behind an ELB and enable SSL on the client side of things. Would only be non-SSL internally at that point. I've done this previously, and it works reasonably well.

^ I still think this is probably the best bet for pretty much immediate IPv6 and SSL support for TMC. :-D

 

[doug]

The issue isn't the cert. It's the mixed elements on the forum. Of course we use SSL on the TMC Connect registration site which is the same domain. Well be full SSL when we change platforms, which will be soon. Perhaps by next week if I can cross all the Ts.

 

[Footbag]

Any chance of getting the forum to work over HTTPS instead of (or in addition to) plain HTTP?

Seems you got your wish!

 

[bmah]

Seems you got your wish!

Indeed I did, thanks @doug! Can I have a pony now too?

 

[doug]

Did you redeem your green bars at the concierge desk?