After login, the home screen shows insecure in chrome

[abdatta]

The login screen shows the site is secure. But just when I log in and the home page appears, the site is shown to be insecure. Why is it so?

[adarshaj]

Its not insecure, its "not fully secure". It shows that due to loading http resources on a https site. You can see that code uses http://home.iitk.ac.in/~username/dp to load pics (because the home.iitk server does not support https). If there was an alternative way to load pics over https then this error would vanish after replacing all such urls in the codebase

[abdatta]

I think that should be easy. Just need to create a reverse proxy url for the insecure image links, isn't it?

[sakshamsharma]

Adding an extra point of failure is rarely a wise decision in the long run. It's best to keep the number of required services to a minimum. Anyway, it's not even an issue worth worrying about frankly. Systems don't need to be complicated Unless there's a clear benefit to be seen.

…

On Thu, Feb 13, 2020, 01:44 Abhishek Datta ***@***.***> wrote: I think that should be easy. Just need to create a reverse proxy url for the insecure image links, isn't it? — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#31?email_source=notifications&email_token=ACPPTJDYBR42K2VTO5J3R2LRCTT6XA5CNFSM4KTUQFZKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOELTTHEQ#issuecomment-585577362>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACPPTJGL3YSS3IB4UX2HI4TRCTT6XANCNFSM4KTUQFZA> .

[adarshaj]

Indeed. It should look very similar to

puppy-love/puppy.nginx.conf

Lines 18 to 26 in 7866cfe

	location /Oa {
	proxy_pass http://oa.cc.iitk.ac.in:80;
	proxy_set_header Connection '';
	add_header 'Access-Control-Allow-Origin' $host;
	proxy_http_version 1.1;
	chunked_transfer_encoding off;
	proxy_connect_timeout 5m;
	proxy_read_timeout 5m;
	}

[adarshaj]

Adding an extra point of failure is rarely a wise decision in the long run. It's best to keep the number of required services to a minimum. Anyway, it's not even an issue worth worrying about frankly. Systems don't need to be complicated Unless there's a clear benefit to be seen.
…

imo, when the website is all pomp about providing a 'secure' service, having the client report that its not 'fully secure' is worth solving. Also, its not as complex as you make it seem, its just 3 more lines to existing config, which already does something very very similar.

[abdatta]

Yes @adarshaj , the very reason I created the issue for something so small is because this service tries to particularly emphasise on its security. So I think if it can be really fixed with something so simple, maybe we should. :)

[sakshamsharma]

Hmm, fine if the nginx is already working then it is definitely cool to do that. I forgot I had added the oa reverse proxy already.