News:

Dear forum visitors, if the support forum is not available, please try again a few minutes later. Thanks!

Main Menu
Support-Forum

edit Download - author website needs https option

Started by shoulders, 19.01.2018 17:02:44

Previous topic - Next topic

0 Members and 1 Guest are viewing this topic.

shoulders

on the option:

Author Data --> Website

the tooltip reads "URL of the authors Website (without http:// in front). This will be shown in the frontend as a link."

Most websites are now going to https:// and I would like to use https://

Also the option below might be affected by the same logic

Author Data --> Author URL or Email

thanks

NB: sorry for all of the posts/feature request, it is just I am a newbie at jDownloads so this makes it the best chance for me to find bugs or usability errors before I get set in my ways.
  •  

ColinM

Hi
Thanks for bring this up. It definitely needs some sorting out but this is far wider than jD.  The basic essence of https is the use of encryption during the transmissions betwen the user device and the web site.

There is actually a responsibility on the https site to handle http based access requests.  Also of course the browser being used has to be able to handle both types.  The reputable browsers do not rely that a http based request will respond with unencrypted content.

As background I have just searched all the source code for incidences of http - there are 1214 hits in 324 files!! For https there were 22 hits in 12 files. Some instances are in code lines checking protocol so a simple substitution does not work.  Another complication are references to some other sites such as www.php.net.  Using http://www.php.net works but using https://www.php.net fails as that site does not have any appropriate 'redirect' or it has no certificate.

If you have an https:// site then on Apache servers you can include the following in your .htaccess file
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

OR in a more explicit form
##   ssl redirect
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://www.sitename.com%{REQUEST_URI} [L,R=301]

The RewriteCond is basically saying if there is no HTTPS then use the following RewriteRule to effectively make it a https:// form. hence the site safely handle both http and https as if the user had used https.

In this situation there is no need to change the http reference to https in the code.
However I am not familiar on how to do this with non Apache based servers.

There is a protocol called HTTP Strict Transport Security (HSTS) where the browser sorts it out but I have not used this.

So what may seem a simple request may cause many challenges to implement properly!
Colin
Colin M
  •  

shoulders

thanks colin, this information will be really useful for other users going forward. I appreciate your view.

My issue was just to allow either the entering of https and http address and let jdowloads parse it out to a proper link or add a dropdown to select the appropriate protocol.

this is awsome site for htaccess stuff https://perishablepress.com/category/htaccess/ .

I also have some links and articles on the subject at my site https://quantumwarp.com/
  •