Skip to content

Insecure mixed content #37

@invisibleroads

Description

@invisibleroads

@AbdourahamaneIssakaSani is accessing jupyterlab via HTTPS, but this fetch method is querying by HTTP, resulting in an insecure mixed content request block.

He seems to be running the latest versions of chrome and firefox. Could it be possible that a proxy is causing this issue? We have not encountered this issue before and the change from HTTPS to HTTP does not happen if I access the same URL from my machine.

        fetch(uri, { method: 'HEAD' }).then(() => {
          launch.isReady = true;
          model.changed.emit();
          clearInterval(launchIntervalId);
        });

https://github.com/crosscompute/jupyterlab-crosscompute/blob/master/src/body.tsx#L273

origin_uri = headers['Origin']

https://github.com/crosscompute/jupyterlab-crosscompute/blob/master/jupyterlab_crosscompute/routines.py#L61

Looking at the code, we are relying on the Origin request header being correct. It is possible that @AbdourahamaneIssakaSani's machine is incorrectly reporting the Origin request header.

Metadata

Metadata

Labels

bugSomething isn't workingpriority

Type

No type

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions