redirect http to https about nb

[JumanaFM]

added the following rule to the Nginx configuration file to redirect all http traffic to https
return 301 https://$host$request_uri;

[karger]

Running our server as https only is probably fine, but remember that we also use an embedded script that could end up hosted on an http page (we can't force *other* people to redirect to https) and would then have to use http to avoid mixed content warnings.  So our api needs to work over both http and https, even if our server is https only.

…

On 11/22/2020 8:11 PM, Jumana Almahmoud wrote: added the following rule to the Nginx configuration file to redirect all http traffic to https |return 301 https://$host$request_uri;| — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#24 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAIWSXXEE2KAYGBAJFE6JJDSRGZCZANCNFSM4T63NOUA>.

[JumanaFM]

@karger I did a couple of tests on http pages and it is working fine. can you give me an example page where this is a problem, so that i can get a better understanding to the issue.

[karger]

I wasn't asserting that it was broken---just warning that we have to watch out.   Your redirect is the right thing to do when people use their browsers to visit the nb site, but you should make sure that requests for the embed-in-page script, and the api requests that embedded script generate, do *not* get redirected because they might be running inside a page with an http address.

…

On 11/22/2020 11:11 PM, Jumana Almahmoud wrote: @karger <https://github.com/karger> I did a couple of tests on http pages and it is working fine. can you give me an example page where this is a problem, so that i can get a better understanding to the issue. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#24 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAIWSXWS37HNNCE3YZ74SY3SRHOF7ANCNFSM4T63NOUA>.

[JumanaFM]

exactly, I tested the embed-in-page script and api requests within http pages. So far all the tests work.