Welcome, Guest
Username: Password: Remember me
Forgot your password? Forgot your username? Create an account
Forum
General Discussion
Public Forums
General Discussion
FreeToastHost HTTPS Support (continued)
×

~~~~~~~~~~~~ IMPORTANT INFORMATION -- Please read! ~~~~~~~~~~~~

1. The "search..." box above searches the Docs & Forum Posts. The "Search" tab above just searches the Forum Posts. :side:
Please use these to search for your issue *before* creating a new message topic, as your issue may have been previously solved.
2. Please put your Club # and Club Web Address in your Forum Signature (best) OR in each post to get faster support from us.
Click here to edit your signature at the bottom of the Profile Information tab.
3. Our user and admin docs are available at: support.toastmastersclubs.org/doc "There's a doc for that!" ;)
4. There is an "Opt In" Feature for newly added members. The Opt In document explains the strikethrough member information. Click Here to View the Post
5. When posting a New Topic , please include all relevant details and be specific. When did your issue 1st occur? What operating system, browser, & browser version are you using? Did you refresh your browser cache? Are your cookies enabled? Lastly, a screen shot is often helpful.
6. Please abide by the Terms of Use . We are volunteers contributing our spare time. We are happy to assist you, so long as you are respectful and courteous.
7. We are always looking for new FreeToastHost Ambassadors to join our team and support fellow Toastmasters in their use of the FreeToastHost website system. If you are familiar with the system and have some interest, send a Send Us a Private Message.
  • Page:
  • 1

TOPIC:

FreeToastHost HTTPS Support (continued) 6 years 10 months ago #63358

  • SteveTheTechie
  • SteveTheTechie's Avatar Topic Author
  • Offline
  • FreeToastHost Developer
  • FreeToastHost Developer
  • Posts: 13529
  • Thank you received: 3831
This is a continuation of the following forum thread: support.toastmastersclubs.org/4-general-...sthost-https-support

I have now pretty much worked out the new functionality for getting Let's Encrypt SSL Certs for HTTPS access for websites with custom domains. Additionally, a single security certificate has been issued to cover the FreeToastHost district websites; e.g., *.toastmastersdistricts.org website domains. (All *.toastmastersclubs.org website domains are handled via a wildcard cert, which is simpler for the system to use.) An automated method of getting a new cert for a custom domain is in place and an automated renewal scheme is also in place for the issued certs for all the custom domains in use.

Certs have been issued for about 700 of the 800+ user registered custom domains now mapped to the FTH server. The ones that did not get a cert issued either were expired domains or did not have their DNS records set up correctly at their registrar. The following custom domains did not get a SSL cert issued for HTTPS access:
www.a-oktoastmasters.org, SSL CERT NOT ISSUED!
www.a1speakers.org.uk, SSL CERT NOT ISSUED!
www.advancedclub.com, SSL CERT NOT ISSUED!
www.aimhightmc.org, SSL CERT NOT ISSUED!
www.allistontm.org, SSL CERT NOT ISSUED!
www.amadorvalleytm.org, SSL CERT NOT ISSUED!
www.ampedtm.com, SSL CERT NOT ISSUED!
www.arcadiatoastmasters.org, SSL CERT NOT ISSUED!
www.astanatoastmasters.org, SSL CERT NOT ISSUED!
www.auroratoastmasters.com, SSL CERT NOT ISSUED!
www.avidspeakers.org, SSL CERT NOT ISSUED!
www.bbtoastmasters.org, SSL CERT NOT ISSUED!
www.bedfordtoastmasters.com, SSL CERT NOT ISSUED!
www.breakfastclubtm.com, SSL CERT NOT ISSUED!
www.brookingstoastmasters.com, SSL CERT NOT ISSUED!
www.capitalcommunicators.org, SSL CERT NOT ISSUED!
www.catawbatoastmasters.org, SSL CERT NOT ISSUED!
www.cavantoastmasters.org, SSL CERT NOT ISSUED!
www.club1489.org, SSL CERT NOT ISSUED!
www.club1600.org, SSL CERT NOT ISSUED!
www.clubdesorateurs.be, SSL CERT NOT ISSUED!
www.counselorstoastmasters.org, SSL CERT NOT ISSUED!
www.crystalbeachtm.ca, SSL CERT NOT ISSUED!
www.cschydtm.com, SSL CERT NOT ISSUED!
www.cstmc.org, SSL CERT NOT ISSUED!
www.diningtospeak.org, SSL CERT NOT ISSUED!
www.district19.me, SSL CERT NOT ISSUED!
www.district80.org, SSL CERT NOT ISSUED!
www.district93.org, SSL CERT NOT ISSUED!
www.dundalktoastmasters.com, SSL CERT NOT ISSUED!
www.dynamicspeakerstt.com, SSL CERT NOT ISSUED!
www.easyspeakers.org, SSL CERT NOT ISSUED!
www.excelenciatoastmasters.com, SSL CERT NOT ISSUED!
www.f5toastmasters.org, SSL CERT NOT ISSUED!
www.franconiaorators.org, SSL CERT NOT ISSUED!
www.franklyspeakingtoastmasters.org, SSL CERT NOT ISSUED!
www.fvsutoastmasters.org, SSL CERT NOT ISSUED!
www.ghanatoastmasters.org, SSL CERT NOT ISSUED!
www.glenfieldtoastmasters.org, SSL CERT NOT ISSUED!
www.globalpridetoastmasters.com, SSL CERT NOT ISSUED!
www.goldenword.net, SSL CERT NOT ISSUED!
www.goreytoastmasters.ie, SSL CERT NOT ISSUED!
www.hillsboroughspeakersclub.com, SSL CERT NOT ISSUED!
hokitikatoastmasters.org.nz, SSL CERT NOT ISSUED!
www.hvtoastmasters.org, SSL CERT NOT ISSUED!
www.innovativespeakerspiv.com, SSL CERT NOT ISSUED!
www.innovatorsclub.net, SSL CERT NOT ISSUED!
www.itoastames.org, SSL CERT NOT ISSUED!
www.jlg1.org, SSL CERT NOT ISSUED!
www.kamfitoastmasters.org, SSL CERT NOT ISSUED!
www.khtoastmasters.com, SSL CERT NOT ISSUED!
www.kildaretoastmasters.org, SSL CERT NOT ISSUED!
www.kingsspeakers.org, SSL CERT NOT ISSUED!
kingstontoastmasters.org.au, SSL CERT NOT ISSUED!
www.kirklandeclectics.org, SSL CERT NOT ISSUED!
www.laderatoastmasters.org, SSL CERT NOT ISSUED!
www.lamplighterstm.org, SSL CERT NOT ISSUED!
www.leadersclubtm.org, SSL CERT NOT ISSUED!
www.leadersincommunication.com, SSL CERT NOT ISSUED!
www.loscolomos.org, SSL CERT NOT ISSUED!
www.madtoasters.net, SSL CERT NOT ISSUED!
www.marcheo.org, SSL CERT NOT ISSUED!
www.melbournetoastmasters.com, SSL CERT NOT ISSUED!
www.memphistm.com, SSL CERT NOT ISSUED!
www.menifeetoastmasters.org, SSL CERT NOT ISSUED!
www.metrospeakers.org, SSL CERT NOT ISSUED!
www.midlandtoastmasters.org, SSL CERT NOT ISSUED!
www.moratuwatoastmasters.com, SSL CERT NOT ISSUED!
morningtalkerstoastmasters.org.au, SSL CERT NOT ISSUED!
www.mountaintoastmasters.com, SSL CERT NOT ISSUED!
www.mountbarkertoastmasters.org, SSL CERT NOT ISSUED!
www.mptoastmasters.com, SSL CERT NOT ISSUED!
www.munichprostmasters.com, SSL CERT NOT ISSUED!
www.nettm.org, SSL CERT NOT ISSUED!
www.nitgoatoastmasters.net, SSL CERT NOT ISSUED!
www.noidatmc.com, SSL CERT NOT ISSUED!
northsydneyachievers.org.au, SSL CERT NOT ISSUED!
www.nunitoastmasters.org, SSL CERT NOT ISSUED!
www.oakvilletoastmasters.ca, SSL CERT NOT ISSUED!
www.oldtowntoastmasters.com, SSL CERT NOT ISSUED!
www.orangevilletoastmasters.com, SSL CERT NOT ISSUED!
www.oswegotoastmasters.org, SSL CERT NOT ISSUED!
www.pasadenacommunitytoastmasters.org, SSL CERT NOT ISSUED!
www.peakperformancetoastmasters.org, SSL CERT NOT ISSUED!
www.platinumspeakers.org, SSL CERT NOT ISSUED!
pmiqtoastmasters.com.au, SSL CERT NOT ISSUED!
www.powertoasters.ca, SSL CERT NOT ISSUED!
www.rathfarnhamtoastmasters.com, SSL CERT NOT ISSUED!
www.rogerstoastmasters.com, SSL CERT NOT ISSUED!
www.roscreaspeaker.com, SSL CERT NOT ISSUED!
www.rosetoasters.com, SSL CERT NOT ISSUED!
rosewoodtoastmasters.org.au, SSL CERT NOT ISSUED!
www.sancaptoastmasters.com, SSL CERT NOT ISSUED!
www.saturdaytoastmasters.org, SSL CERT NOT ISSUED!
www.seoultm.org, SSL CERT NOT ISSUED!
www.setoasters.com, SSL CERT NOT ISSUED!
www.sfstoastmasters.com, SSL CERT NOT ISSUED!
www.shttoastmasters.com, SSL CERT NOT ISSUED!
www.siemenstoastmasters.biz, SSL CERT NOT ISSUED!
www.southmainspeakers.org, SSL CERT NOT ISSUED!
www.spacelandtoastmasters.com, SSL CERT NOT ISSUED!
www.srtmkorea.org, SSL CERT NOT ISSUED!
www.stellartoastmasters.org, SSL CERT NOT ISSUED!
www.stepokc.org, SSL CERT NOT ISSUED!
www.sterlingspeakers.org, SSL CERT NOT ISSUED!
www.sunrisecentertoastmasters.org, SSL CERT NOT ISSUED!
www.sunrisers.ca, SSL CERT NOT ISSUED!
www.taichungtoastmasters.org, SSL CERT NOT ISSUED!
www.taratoastmasters.org, SSL CERT NOT ISSUED!
www.tarentaaltoastmasters.com, SSL CERT NOT ISSUED!
www.thursdaynoontalkers.org, SSL CERT NOT ISSUED!
www.toastmasters-mons.be, SSL CERT NOT ISSUED!
www.toastmasters1913.org, SSL CERT NOT ISSUED!
www.toastmasters2497.org, SSL CERT NOT ISSUED!
www.toastmastershasselt.be, SSL CERT NOT ISSUED!
www.toastmastersmadrid.com, SSL CERT NOT ISSUED!
www.toastmastersucsb.com, SSL CERT NOT ISSUED!
www.tongue-tiedtoasters.org, SSL CERT NOT ISSUED!
www.topcatstoastmasters.us, SSL CERT NOT ISSUED!
www.tortolatoastmastersclub.org, SSL CERT NOT ISSUED!
www.traffictoastmasters.org, SSL CERT NOT ISSUED!
www.transportationtm.org, SSL CERT NOT ISSUED!
www.transuniontoastmasters.com, SSL CERT NOT ISSUED!
www.tuesdaytoasters.org, SSL CERT NOT ISSUED!
www.usftm.com, SSL CERT NOT ISSUED!
www.waverleycommunicators.org, SSL CERT NOT ISSUED!
www.westpaccitytm.org, SSL CERT NOT ISSUED!
www.winetastingmasters.org, SSL CERT NOT ISSUED!
www.yubacitytoastmasters.com, SSL CERT NOT ISSUED!
www.ztoasters.com, SSL CERT NOT ISSUED!

99% of these will require intervention by the club's website admin in order to permit certs to be issued. I have already done as much as I can on our end to maximize the likelihood of successful SSL cert issuance from Let's Encrypt. We can advise you how to resolve these issues (details of the errors are in our cert issuance log file), but you will need to make the fixes yourself. In some cases, you may need to make adjustments to your domain's DNS records at you domain registrar in order to permit you to get a SSL cert for HTTPS access.

Please keep in mind that not having HTTPS access does not prevent you from accessing or using your FTH website. However, having the HTTPS access does allow for encrypted communications between the FTH server and the browsers that your members and visitors use to access your website. The goal of using encrypted communications is to prevent hackers from stealing private information such as contact information and passwords.
Regards,

Steve James, DTM
FreeToastHost System Developer
Officer Emeritus, Mindful Communicators (Club 1966, District 52) A President's Distinguished Club for each of the last 10 years.

>>> Please put your club number in your forum profile. CLICK here to edit your profile.
Last edit: by SteveTheTechie.
The topic has been locked.

FreeToastHost HTTPS Support (continued) 6 years 10 months ago #63359

  • SteveTheTechie
  • SteveTheTechie's Avatar Topic Author
  • Offline
  • FreeToastHost Developer
  • FreeToastHost Developer
  • Posts: 13529
  • Thank you received: 3831
In general, I have found that it may take several hours (depending on server traffic) for the FTH server to assimilate the required server configuration file that is created for a new SSL cert for a new domain. This is because the server has to restart all website operations in order incorporate the one new configuration file for the new domain. I have configured the code to make the server do this "gracefully", so the server will do this restart at a time that is not as disruptive to the overall website operations. Thus, you may need to wait a bit to access your website w/ HTTPS when you add a custom domain name.

Currently, HTTPS access is not being enforced. You can access your website via HTTP or HTTPS. This is intended to give clubs time to get used to using HTTPS and to address any insecure content in their websites. In the near future, I will provide an optional setting to allow HTTPS to be enforced on a club by club basis.

I need to work out what "enforcing HTTPS access" will mean for the system. Currently, my thoughts are the following for clubs/districts that want to enforce HTTPS access:

1. A website user who tries to access the website via simple HTTP will be redirected to the website using HTTPS. The user will not be given the option of accessing via HTTP.

2. An additional warning message will be shown when attempting to save content that contains http: URLs.

If you are interested in this, then please offer your input here in this thread.
Regards,

Steve James, DTM
FreeToastHost System Developer
Officer Emeritus, Mindful Communicators (Club 1966, District 52) A President's Distinguished Club for each of the last 10 years.

>>> Please put your club number in your forum profile. CLICK here to edit your profile.
Last edit: by SteveTheTechie.
The topic has been locked.

FreeToastHost HTTPS Support (continued) 6 years 10 months ago #63360

  • SteveTheTechie
  • SteveTheTechie's Avatar Topic Author
  • Offline
  • FreeToastHost Developer
  • FreeToastHost Developer
  • Posts: 13529
  • Thank you received: 3831
I will need to create some user documentation for this... For now, here are some quick notes and how to's...

I am using Chrome these days, and in Chrome what you are looking for to ensure that a webpage is actually totally secured when accessing it via https is the following:


If you see the letter i in a circle, that means that some content is your page is not being accessed securely. This will usually be an image, a link, or an iframe. (These are most common.)

Regards,

Steve James, DTM
FreeToastHost System Developer
Officer Emeritus, Mindful Communicators (Club 1966, District 52) A President's Distinguished Club for each of the last 10 years.

>>> Please put your club number in your forum profile. CLICK here to edit your profile.
Attachments:
Last edit: by SteveTheTechie.
The topic has been locked.

FreeToastHost HTTPS Support (continued) 6 years 10 months ago #63361

  • SteveTheTechie
  • SteveTheTechie's Avatar Topic Author
  • Offline
  • FreeToastHost Developer
  • FreeToastHost Developer
  • Posts: 13529
  • Thank you received: 3831
To check for content on a webpage that is accessed in an insecure manner (e.g., "mixed content"), there are several approaches you can use...
1. You can use one of the several online insecure content checkers that are available:
www.google.com/search?q=https+insecure+c...ceid=chrome&ie=UTF-8

For example, here is output from www.whynopadlock.com (I added the yellow highlight below):

2. You also can just use the right click menu on content in your web pages to access the Inspect function. This function will let you see the urls for your content so that you can verify that they are not accessed via http: (Again, I added the highlight below.)
3. You can inspect your raw html via the editor's View Source function.
Regards,

Steve James, DTM
FreeToastHost System Developer
Officer Emeritus, Mindful Communicators (Club 1966, District 52) A President's Distinguished Club for each of the last 10 years.

>>> Please put your club number in your forum profile. CLICK here to edit your profile.
Attachments:
Last edit: by SteveTheTechie.
The topic has been locked.

FreeToastHost HTTPS Support (continued) 6 years 10 months ago #63362

  • SteveTheTechie
  • SteveTheTechie's Avatar Topic Author
  • Offline
  • FreeToastHost Developer
  • FreeToastHost Developer
  • Posts: 13529
  • Thank you received: 3831
My guidance for content URLs is that, whenever possible, you should strive to use relative URLs for content that is stored on the FreeToastHost server. This will give you flexibility and allow https to be automatically used whenever possible.

What is a relative url? Simply put it is just a url that is missing the website name--the website name is implied to be the current website name. For example:
http://www.mindfulcommunicators.org/imageuploads/1966/newofficers.png  is a fully qualified url.

/imageuploads/1966/newofficers.png   is a relative url that points the the same image as above.

For content that is *external*, not on the FreeToastHost server (e.g., like a image on your Facebook page), you should test the url with https to see if it can work. If not, then use http.
Regards,

Steve James, DTM
FreeToastHost System Developer
Officer Emeritus, Mindful Communicators (Club 1966, District 52) A President's Distinguished Club for each of the last 10 years.

>>> Please put your club number in your forum profile. CLICK here to edit your profile.
Last edit: by SteveTheTechie.
The topic has been locked.

FreeToastHost HTTPS Support (continued) 6 years 10 months ago #63365

  • tund3r
  • tund3r's Avatar
  • Offline
  • Senior Member
  • Senior Member
  • Posts: 49
  • Thank you received: 11
I'm glad it worked, good job and thank you!!
Andrea Dalle Molle
VPE Miami Beach Toastmasters
Club: 1293723
The following user(s) said Thank You: SteveTheTechie
The topic has been locked.

FreeToastHost HTTPS Support (continued) 6 years 10 months ago #63366

  • SteveTheTechie
  • SteveTheTechie's Avatar Topic Author
  • Offline
  • FreeToastHost Developer
  • FreeToastHost Developer
  • Posts: 13529
  • Thank you received: 3831

I'm glad it worked, good job and thank you!!


It was a *lot* of work (& my spare time) to get the the Lets Encrypt stuff set up. :pinch: There was a good bit of server code that needed to be created around automated cert issuance, renewal, and revocation.

I tend to think that very few clubs really care about HTTPS... Perhaps you are in the vocal minority? We shall see. ;)
Regards,

Steve James, DTM
FreeToastHost System Developer
Officer Emeritus, Mindful Communicators (Club 1966, District 52) A President's Distinguished Club for each of the last 10 years.

>>> Please put your club number in your forum profile. CLICK here to edit your profile.
The following user(s) said Thank You: sandiewright
Last edit: by SteveTheTechie.
The topic has been locked.

FreeToastHost HTTPS Support (continued) 6 years 10 months ago #63373

  • SteveTheTechie
  • SteveTheTechie's Avatar Topic Author
  • Offline
  • FreeToastHost Developer
  • FreeToastHost Developer
  • Posts: 13529
  • Thank you received: 3831
Additional Information:
  • The automated SSL cert renewal routine runs at 6am (GMT) every Sunday morning. It takes about 10 minutes to complete.
  • The district SSL cert is automatically renewed at 6am (GMT) on the 15th of each month. It takes less than a minute to complete.
To check the expiration date of the SSL cert for HTTPS access for your website, you can use the following if you are using Google Chrome as your browser: www.howtogeek.com/292076/how-do-you-view...ls-in-google-chrome/
Regards,

Steve James, DTM
FreeToastHost System Developer
Officer Emeritus, Mindful Communicators (Club 1966, District 52) A President's Distinguished Club for each of the last 10 years.

>>> Please put your club number in your forum profile. CLICK here to edit your profile.
The following user(s) said Thank You: sandiewright
Last edit: by SteveTheTechie.
The topic has been locked.

FreeToastHost HTTPS Support (continued) 6 years 10 months ago #63381

  • gpeters
  • gpeters's Avatar
  • Offline
  • Junior Member
  • Junior Member
  • Posts: 28
  • Thank you received: 7
Many thanks Steve. that is great! HTTPS is now working for our domain. We would like to enable the option to Enforce HTTPS on our domain. The option to do this would be great as well. Please let me know!
Regards,
Geoff
Geoff Peters
Co-Sergeant at Arms
Vancouver Toastmasters Club #59
tmclub59.com

Find me on Twitter at twitter.com/gpeters
The topic has been locked.

FreeToastHost HTTPS Support (continued) 6 years 10 months ago #63382

  • SteveTheTechie
  • SteveTheTechie's Avatar Topic Author
  • Offline
  • FreeToastHost Developer
  • FreeToastHost Developer
  • Posts: 13529
  • Thank you received: 3831

Many thanks Steve. that is great! HTTPS is now working for our domain. We would like to enable the option to Enforce HTTPS on our domain. The option to do this would be great as well. Please let me know!
Regards,
Geoff


I mentioned above, I need to work out what "enforcing HTTPS access" will mean for the system... In other words, what all such a setting would impact... Any thoughts?
Regards,

Steve James, DTM
FreeToastHost System Developer
Officer Emeritus, Mindful Communicators (Club 1966, District 52) A President's Distinguished Club for each of the last 10 years.

>>> Please put your club number in your forum profile. CLICK here to edit your profile.
The topic has been locked.

FreeToastHost HTTPS Support (continued) 6 years 10 months ago #63383

  • gpeters
  • gpeters's Avatar
  • Offline
  • Junior Member
  • Junior Member
  • Posts: 28
  • Thank you received: 7
Hi Steve,

I think that what you proposed, an option in the Admin screen to turn on the behavior: "A website user who tries to access the website via simple HTTP will be redirected to the website using HTTPS. The user will not be given the option of accessing via HTTP." Would work perfectly for us.

Many thanks!
Geoff
Geoff Peters
Co-Sergeant at Arms
Vancouver Toastmasters Club #59
tmclub59.com

Find me on Twitter at twitter.com/gpeters
The topic has been locked.

FreeToastHost HTTPS Support (continued) 6 years 10 months ago #63386

  • SteveTheTechie
  • SteveTheTechie's Avatar Topic Author
  • Offline
  • FreeToastHost Developer
  • FreeToastHost Developer
  • Posts: 13529
  • Thank you received: 3831

Hi Steve,

I think that what you proposed, an option in the Admin screen to turn on the behavior: "A website user who tries to access the website via simple HTTP will be redirected to the website using HTTPS. The user will not be given the option of accessing via HTTP." Would work perfectly for us.

Many thanks!
Geoff


Ok, but what about your content that contains http urls? This is where most of my thinking is focused on.

For example, the image on your club home page is using http, not https. Therefore, not everything in your site is using https, thus no Secure tag to the left of the address bar.

My point is whether I should provide warnings for saving insecure content or not when enforce https is enabled.
Regards,

Steve James, DTM
FreeToastHost System Developer
Officer Emeritus, Mindful Communicators (Club 1966, District 52) A President's Distinguished Club for each of the last 10 years.

>>> Please put your club number in your forum profile. CLICK here to edit your profile.
The topic has been locked.

FreeToastHost HTTPS Support (continued) 6 years 10 months ago #63389

  • gpeters
  • gpeters's Avatar
  • Offline
  • Junior Member
  • Junior Member
  • Posts: 28
  • Thank you received: 7
Hi Steve,
In my opinion, the warning would be nice, it would possibly help out webmasters, but I think it could be added later if needed.

Thanks for the tip about our images, I will work on fixing those up!
Regards,
Geoff
Geoff Peters
Co-Sergeant at Arms
Vancouver Toastmasters Club #59
tmclub59.com

Find me on Twitter at twitter.com/gpeters
The topic has been locked.

FreeToastHost HTTPS Support (continued) 6 years 10 months ago #63396

  • SteveTheTechie
  • SteveTheTechie's Avatar Topic Author
  • Offline
  • FreeToastHost Developer
  • FreeToastHost Developer
  • Posts: 13529
  • Thank you received: 3831
So, I have been digging into Content Security Policies a bit, and I think I can use those to deal the potential issues with insecure content.

Basically, a Content Security Policy is a sort of white list that the server sends to your browser to tell it where it is safe to load content in the website from. I can set these "white lists" up for the following types of content: fonts, iframes, images, videos, objects, scripts, and styles (there are also others, but these are what are relevant to us)

For example, if I wanted to inform browsers that it is safe to load any images from our server, I could send the following to the browsers:
Content-Security-Policy:   image-src 50.19.253.65

If I wanted to say that any content from our server is safe, I think I could make the code send the following to the browsers:
Content-Security-Policy:   default-src 50.19.253.65

In summary, I think that if HTTPS is being enforced, then I should make the code automatically use reasonable content security policies to make it manageable for clubs.

Given this, does anyone have any feedback on this? For instance, I think that images should be considered safe regardless of where they come from and regardless of whether they are using http or https. Scripts, on the other hand are a different story, because of problems they can cause.
Regards,

Steve James, DTM
FreeToastHost System Developer
Officer Emeritus, Mindful Communicators (Club 1966, District 52) A President's Distinguished Club for each of the last 10 years.

>>> Please put your club number in your forum profile. CLICK here to edit your profile.
Last edit: by SteveTheTechie.
The topic has been locked.

FreeToastHost HTTPS Support (continued) 6 years 10 months ago #63397

  • gpeters
  • gpeters's Avatar
  • Offline
  • Junior Member
  • Junior Member
  • Posts: 28
  • Thank you received: 7
Interesting! I think the images side would be helpful.

But as far as what we need, I was able to trace down all the non https images on our site and now the secure lock appears! But for someone who doesn't know much about websites, this might be a challenging task.
Geoff Peters
Co-Sergeant at Arms
Vancouver Toastmasters Club #59
tmclub59.com

Find me on Twitter at twitter.com/gpeters
The topic has been locked.

FreeToastHost HTTPS Support (continued) 6 years 10 months ago #63398

  • SteveTheTechie
  • SteveTheTechie's Avatar Topic Author
  • Offline
  • FreeToastHost Developer
  • FreeToastHost Developer
  • Posts: 13529
  • Thank you received: 3831

Interesting! I think the images side would be helpful.

But as far as what we need, I was able to trace down all the non https images on our site and now the secure lock appears! But for someone who doesn't know much about websites, this might be a challenging task.


Ok, but I do not design functionality just for one club. :)
Regards,

Steve James, DTM
FreeToastHost System Developer
Officer Emeritus, Mindful Communicators (Club 1966, District 52) A President's Distinguished Club for each of the last 10 years.

>>> Please put your club number in your forum profile. CLICK here to edit your profile.
Last edit: by SteveTheTechie.
The topic has been locked.

FreeToastHost HTTPS Support (continued) 6 years 10 months ago #63411

  • SteveTheTechie
  • SteveTheTechie's Avatar Topic Author
  • Offline
  • FreeToastHost Developer
  • FreeToastHost Developer
  • Posts: 13529
  • Thank you received: 3831
I believe the following reference is particularly relevant to what I am after w/ HTTPS and Content Security Policy:

developers.google.com/web/fundamentals/s...fixing-mixed-content
Regards,

Steve James, DTM
FreeToastHost System Developer
Officer Emeritus, Mindful Communicators (Club 1966, District 52) A President's Distinguished Club for each of the last 10 years.

>>> Please put your club number in your forum profile. CLICK here to edit your profile.
The topic has been locked.
  • Page:
  • 1
Moderators: Pam, rhtaylor3, jliu, marc33, NotLiable, deedubbleyoo, NSB, Phyllis Kirouac
Forum
General Discussion
Public Forums
General Discussion
FreeToastHost HTTPS Support (continued)
Time to create page: 0.097 seconds
Powered by Kunena Forum