Skip to content
This repository was archived by the owner on Oct 6, 2021. It is now read-only.
This repository was archived by the owner on Oct 6, 2021. It is now read-only.

Insecure links and loading #200

Open
Open
Insecure links and loading#200
Labels
SECURITYconfigux

Description

@alfalfascout
alfalfascout
opened on Jan 28, 2018
  • Check this box if this is a security vulnerability.

Summary

Airship keeps trying to load things over http and submit forms over http even when the current page is served over https. As a result, I can't log in and I'm getting console errors.

Expected Outcome

I could log into the bridge and start doing things with my airship

What Actually Happened

bridge:11 Refused to load the stylesheet 'http://xxx.xxx.com/bridge/motif_extra.css' because it violates the following Content Security Policy directive: "style-src 'self' 'unsafe-inline'".

bridge:35 Mixed Content: The page at 'https://xxx.xxx.com/bridge' was loaded over a secure connection, but contains a form that targets an insecure endpoint 'http://xxx.xxx.com/bridge/login'. This endpoint should be made available over a secure connection.

bridge:1 Refused to load the stylesheet 'http://xxx.xxx.com/bridge/motif_extra.css' because it violates the following Content Security Policy directive: "style-src 'self' 'unsafe-inline'".

Submitting the form does nothing.

Activity

  1. paragonie-scott commented on Jan 28, 2018

    @paragonie-scott
    paragonie-scott
    on Jan 28, 2018
    Member

    That has to do with how the current Cabin is configured. Check src/Cabins/Bridge/config.json.

  2. paragonie-scott
    added
    ux
    SECURITY
    config
    on Jan 28, 2018

  3. alfalfascout commented on Jan 28, 2018

    @alfalfascout
    alfalfascout
    on Jan 28, 2018
    Author

    There is no such directory as src/Cabins/Bridge in my airship directory.
    In src/Cabin/Bridge, there is no such file as config.json.

  4. paragonie-scott commented on Jan 28, 2018

    @paragonie-scott
    paragonie-scott
    on Jan 28, 2018
    Member

    Sorry, src/Cabins/Bridge/config/config.json.

  5. paragonie-scott commented on Jan 28, 2018

    @paragonie-scott
    paragonie-scott
    on Jan 28, 2018
    Member

    Actually, wrong file. Check src/config/cabins.json and look at the canon_url property.

  6. alfalfascout commented on Jan 28, 2018

    @alfalfascout
    alfalfascout
    on Jan 28, 2018
    Author

    That's very strange. The canon_url is http even tho I set https to true. It feels like that shouldn't be possible.

  7. paragonie-scott commented on Jan 28, 2018

    @paragonie-scott
    paragonie-scott
    on Jan 28, 2018
    Member

    It's a configuration thing. I'm working on a patch in my other window. Give me 10 or 15 minutes and it'll be fixed in dev-master.

  8. alfalfascout commented on Jan 28, 2018

    @alfalfascout
    alfalfascout
    on Jan 28, 2018
    Author

    I have updated the canon_url to be https, but I'm still getting these errors. I hope that helps you in planning your fix.

  9. paragonie-scott commented on Jan 28, 2018

    @paragonie-scott
    paragonie-scott
    on Jan 28, 2018
    Member

    6189af6 should fix it. It's probably caching too, but this fixes it as it's retrieved.

  10. alfalfascout commented on Jan 28, 2018

    @alfalfascout
    alfalfascout
    on Jan 28, 2018
    Author

    I'm not getting those errors anymore, but I am getting Exciting, New Errors. I'll see if I can figure them out.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    SECURITYconfigux

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions