issues using https to access FlyerTalk
Apr 17, 2016 | 3:40 pm
#1
Original Poster
Moderator: Hyatt, American Express; FlyerTalk Evangelist
Join Date: Jun 2015
Location: WAS
Programs: :rolleyes:, DL DM, AA EXP, UA Silver, Hyatt Glob, Mlife Noir (=> Marriott Amb), invol FT beta tester
Posts: 21,590
issues using https to access FlyerTalk
Is using https to access FlyerTalk (i.e. using https:// in the URL instead of just plain http) officially supported, or is it a just-happens-to-work sort of thing?
I have noticed two issues:
1. Chrome reports:
The cause, and how to remedy it in the web server settings, is described here:
http://security.stackexchange.com/qu...te-cryptograph
2. When a post includes an image attachment (such as the one above) the HTML source for the thumbnail uses an absolute http URL reference for the IMG SRC attribute. If the post is viewed via https, the presence of an http image, depending on the browser settings, results in either a mixed content warning or causes the image to be omitted entirely. It should hopefully be trivial to fix how thumbnails are included on the page to use a URL relative to the docroot so that it uses the same scheme of https or http as was originally used to fetch the underlying page.
I have noticed two issues:
1. Chrome reports:
The cause, and how to remedy it in the web server settings, is described here:
http://security.stackexchange.com/qu...te-cryptograph
2. When a post includes an image attachment (such as the one above) the HTML source for the thumbnail uses an absolute http URL reference for the IMG SRC attribute. If the post is viewed via https, the presence of an http image, depending on the browser settings, results in either a mixed content warning or causes the image to be omitted entirely. It should hopefully be trivial to fix how thumbnails are included on the page to use a URL relative to the docroot so that it uses the same scheme of https or http as was originally used to fetch the underlying page.
Apr 18, 2016 | 6:18 pm
#2
Administrator
Join Date: Apr 2008
Location: Los Angeles, CA
Programs: SPG
Posts: 607
We are not able to achieve a full green lock condition due to third party advertisers and other pixels being references via non-ssl. We do support SSL login, I believe that was the main request for SSL. When logging in the credentials are transported via SSL. We don't fully support SSL across 100% of the site.