Logins, HTTP/S Redirect

[MetalgodZ]

I'm seeing a bunch of people in threads here with login issues, and I've noticed one in particular recently that someone (moderator, administrator) might be able to fix.

Some of my old bookmarks were created without the "s" ("http://" instead of "https://") and the insecure pages do not show me logged in. I *can* log in on the pages, if I wanted to put a password into an insecure page, but it doesn't automatically push me to https. Manually adding the "s" drops me onto a page where I'm already logged in.

Auto-redirect might be something to consider, unless you've already done so and specifically chosen not to for some reason.

 

[BenDover]

There is an add on called “https everywhere” written by the electronic frontier foundation. It will attempt to upgrade any site you visit to SSL. Think its available for Chrome and Firefox.

 

[sHORTY]

I'm seeing a bunch of people in threads here with login issues, and I've noticed one in particular recently that someone (moderator, administrator) might be able to fix.

Some of my old bookmarks were created without the "s" ("http://" instead of "https://") and the insecure pages do not show me logged in. I *can* log in on the pages, if I wanted to put a password into an insecure page, but it doesn't automatically push me to https. Manually adding the "s" drops me onto a page where I'm already logged in.

Auto-redirect might be something to consider, unless you've already done so and specifically chosen not to for some reason.

A metric ton of people complained when we tried to force https so we decided to make it pseudo-optional.

I might revisit this given the increased acceptance at this point.

 

[MetalgodZ]

There is an add on called “https everywhere” written by the electronic frontier foundation. It will attempt to upgrade any site you visit to SSL. Think its available for Chrome and Firefox.

It's installed. But I do enough work with self-signed and un-signed management pages that I either turn it off, or end up putting in dozens to hundreds of exceptions. It's an annoyance, but not a huge one.

A metric ton of people complained when we tried to force https so we decided to make it pseudo-optional.

I might revisit this given the increased acceptance at this point.

Oh, FFS. Seriously? ::insert facepalm here::

Was it a cert issue that they were complaining about? I can't even think of a proper https implementation that drew my attention to it as it happened, over the past 4 or 5 years.


(Yeah, I *could* fix my bookmarks and delete my browser history & cache and then log into the https again without using http, to update the default. It's just something I ran into and I wasn't aware that it'd already been addressed.)