TOPIC:

Continuing on with our HTTPS implementation (support.toastmastersclubs.org/4-general-...ps-support-continued), I have added a new setting (a drop-down) to the Website Settings => Basic Settings Tab. (see below)

This setting will allow interested clubs to force website users to access the website with HTTPS (encrypted) access for better security. By default, this setting will not be enabled. However, I am adding this setting to allow security-conscious clubs and districts to fully deploy HTTPS for their websites.



When enabled, the setting makes the system do a redirect to HTTPS when the website is accessed via HTTP. Since browsers actually cache redirects, I have also added a "cache buster" parameter (current decimal time) to the end of the URL when this redirect happens to prevent past redirects in the browser cache from interfering. (see below) Right now, i am a little bit uneasy about this cache buster parameter as it may cause other problems--however, I tend to believe that preventing confusion from cached redirects is beneficial, so I am going with this approach for now to see how it goes.

Note that I may add additional options to this drop-down in the future to enable more control over the HTTPS Policy. (This is the initial roll-out)

Additionally, moving forward, I may use this setting to trigger functionality in other parts of the system. For example, showing a warning when someone is saving insecure content w/ HTTPS enforcement enabled.

Why do we need this? Who would be interested in Toastmaster's data? If the FTH server was hacked, there would be email, phone and name data. There isn't any credit card, address or SS#'s data stored.

If there is a possibility that it might not work on some people's computers it will create a lot of extra work for admins.

Some browser are showing warnings if you are not using HTTPS.

I believe that websites using HTTPS tend to rank higher in Google search results.

I think HTTPS will eventually just become the norm. Our current implementation, while not perfect, is intended to support clubs that want to use it. You are not required to use it.