Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implementing HTTPS/SSL certification on your server #8

Closed
alexweissman opened this issue Apr 15, 2014 · 5 comments
Closed

Implementing HTTPS/SSL certification on your server #8

alexweissman opened this issue Apr 15, 2014 · 5 comments
Labels
confirmed bug Something isn't working question Further information is requested

Comments

@alexweissman
Copy link
Member

From what I've been reading, "free" certificates are trouble. I ended up buying a cheap $9/yr cert from Namecheap (who resells for Comodo) for my website, and installation went pretty smoothly.

As far as compatibility, there are a few places in the code base where "http" is hard-coded, notably logout.php. This can cause browsers to (rightfully) complain about "mixed content", so we should fix that to use the appropriate protocol for https versions of websites that implement UserFrosting.

@alexweissman alexweissman changed the title Implementing HTTPS/SSL certification on your server for free Implementing HTTPS/SSL certification on your server Apr 16, 2014
@alexweissman
Copy link
Member Author

Importance of hosting your entire site over HTTPS: https://www.eff.org/https-everywhere/deploying-https

@alexweissman
Copy link
Member Author

We should implement "bulletproof sessions" as per http://blog.teamtreehouse.com/how-to-create-bulletproof-sessions.

@alexweissman
Copy link
Member Author

project is now SSL/https compatible, but we still need to implement "bulletproof sessions". This has been added to the TODO list.

@r3wt
Copy link

r3wt commented Apr 19, 2014

alex, right now SSL is very likely insecure, a false security blanket. some of the webs greatest minds are digging through the source code, and it doesn't look very good. Luckily, OpenBSD has taken over the project and they are in the process of rewriting it. Its hard, but its possible to hack SSL communications at the moment. This being said, its unlikely that any of our sitea would be the target for such hacks. There would have to be significant financial gain to lure the eye of a capable hacker. for more information, here: http://opensslrampage.org/

@alexweissman
Copy link
Member Author

Wow, that's crazy. Don't really understand much of what I see on that site...have they found anything else interesting since Heartbleed?
For the purposes of this project, I think advising users to implement HTTPS is better than nothing. As Firesheep made abundantly clear, it's so easy for casual attackers to grab sensitive data from unsecured connections.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
confirmed bug Something isn't working question Further information is requested
Projects
None yet
Development

No branches or pull requests

2 participants