[FR] force SSL/HTTPS for the website

[Matthias Hoffmann]

Hi.

I just want to encourage, to force SSL/HTTPS. This could be done in either really force this (don't accepting non-SSL-Connections) or (the way I would suggest) by redirecting to the HTTPS-Site... This would be a very good idea I think, because very often I am not looking at the URL-Row and overseen, that I'am on an http Connection. I think many of us is happening this too and I can't see a good reason why not to redirect to the SSL-Page... I mean I don't know how often I accidentally sent my Clear-Text-Password across the internet because of this missing feature...

 

[Christopher Bennett]

Well here is one reason

Xacars doesn't support the https protocol. I have already tried forcing https and it broke just about every reporting tool we have. So for now until the reporting clients are updated to support secure connections this ist what we have. Meanwhile I am still working on the new system but all by myself, so this will continue to take time. I started a new job the beginning of the year so now have more free time as I only work 4 days a week now so hopefully on that front we will be getting some work done.

 

[Matthias Hoffmann]

Which webserver are we using actually? AFAIK Nginx was able to force https only for specific directorys :think:

 

[Christopher Bennett]

I think it is being served by an Apache nginx combo.

I will double check to see if we can fix this. I have Monday through Wednesday off so that bc would be a perfect time to fix this.

 

[Matthias Hoffmann]

If you need help with this, you can ask me (I am actually running Nginx, but in before I had experience with Apache2). This is also if you need help with PHP 7-Stuff... I am actually working with PHP 7 and it's the language, that I am best in. Actually I am working on Tools for Public Transport, which will be Open Source since first Release.

Edit: If someone want's to know more about my projects off Air-Child, let's move to the off-Topic Secction of this Forum