Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

HTTP used to get gravatar images instead of HTTPS #79

Open
ghost opened this issue Aug 3, 2015 · 0 comments
Open

HTTP used to get gravatar images instead of HTTPS #79

ghost opened this issue Aug 3, 2015 · 0 comments
Milestone

Comments

@ghost
Copy link

ghost commented Aug 3, 2015

When Zuul is configured to use an SSL connection, browsers have a warning icon over the SSL "lock" icon that indicates a secure connection on any page that includes a Gravatar image. When you click on the SSL warning icon for details, it says "...this page includes other resources which are not secure. These resources can be viewed by others while in transit, and can be modified by an attacker to change the look of the page...". I checked the console tab using Google Chrome developer tools, and it confirmed that the problem was being caused by HTML <img> elements that are referencing Gravatar images using "http://" in the src attribute instead of "https://". Gravatar supports both HTTP and HTTPS when referencing Gravatar avatar URLs, so fixing this issue is a simple matter of changing the code in Zuul to put "https://" in front of Gravatar avatar URLs instead of "http://".

Also, even if Zuul is set up without any SSL encryption, using HTTPS in the Gravatar links would still work just fine since the Gravatar images are on Gravtar's servers, so even if Zuul isn't using HTTPS, Gravatar images will still work when secured (even though running Zuul without any SSL set up would be HIGHLY inadvisable from a security perspective).

Screenshot of SSL Warning When Clicking On SSL Lock Warning Icon:
screenshot1

Screenshot of Chrome Developer Tools Console Showing References Causing Warning:
screenshot2

@psmith psmith added this to the 1.7.1 milestone Dec 10, 2015
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant