MGBrose Posted October 23, 2013 Share Posted October 23, 2013 I fully acknowledge that both Full site ssl via https in the config file and the current toggle for "login using https/ssl" both work for 3.4, however we are missing a number of features in regards to both using CDN's and more granular control over SSL usage in IPBoard. I suspect that a lack of support for some of these features, especially CDN's, is making it more difficult for admins to utilize https/ssl for their communities. High Priority: SSL doesnt work properly with CDN's. Many CDN's now support SSL including amazon cloudfront. We should have alternate https/ssl cdn text fields in the backend. Which means we need an alternate ssl urls fields for the following items within general configuration: Images URL, Upload URLS, CSS URL, JS URL, SSL on login shouldnt force inline stylesheet if SSL CDN urls are available (see above). SSL for admin should have its own toggle via acp. Slightly Lower Priority: SSL isn't optional for the user(outside of login pages if thats enabled), this is nice functionality to have for users to control individually, if they want enhanced security perhaps they could click a special icon that toggles https/ssl mode (or a user profile setting) IPS should consider making all https/ssl toggles (like ssl for logins, and ssl for admin) controllable via a config file to keep admins from potentially locking themselves out with those settings. Link to comment Share on other sites More sharing options...
stoo2000 Posted October 23, 2013 Share Posted October 23, 2013 For the CDN/Upload/JS urls just miss out the protocol.i.e.//yourcdnurl.com Link to comment Share on other sites More sharing options...
MGBrose Posted October 23, 2013 Author Share Posted October 23, 2013 interesting I didnt think that was possible. Originally as an example of my setup for my site: I was thinking I could do 2 sets of urls non https --> https (2 seperate urls) upload http://ups.mazda626.net ----> https://d1u9jyesu396vx.cloudfront.net css http://sd1.mazda626.net ----> https://dnma4hc22tbaa.cloudfront.net images http://pb.mazda626.net ----> https://d3bjtoatzo001g.cloudfront.net js http://sd1.mazda626.net ----> https://dnma4hc22tbaa.cloudfront.net but now that you mention that, as long as it works for me I can simply use //d1u9jyesu396vx.cloudfront.net //dnma4hc22tbaa.cloudfront.net //d3bjtoatzo001g.cloudfront.net //dnma4hc22tbaa.cloudfront.net I'll 100% have to give that a shot! The other issue I'm seeing though is that will only work for full sitewide https encryption via config file, not via "use https for logins" because use https for logins still pulls from inline stylesheets. Link to comment Share on other sites More sharing options...
GreenLinks Posted October 23, 2013 Share Posted October 23, 2013 interesting I didnt think that was possible. Originally as an example of my setup for my site: I was thinking I could do 2 sets of urls non https --> https (2 seperate urls) upload http://ups.mazda626.net ----> https://d1u9jyesu396vx.cloudfront.net css http://sd1.mazda626.net ----> https://dnma4hc22tbaa.cloudfront.net images http://pb.mazda626.net ----> https://d3bjtoatzo001g.cloudfront.net js http://sd1.mazda626.net ----> https://dnma4hc22tbaa.cloudfront.net but now that you mention that, as long as it works for me I can simply use //d1u9jyesu396vx.cloudfront.net //dnma4hc22tbaa.cloudfront.net //d3bjtoatzo001g.cloudfront.net //dnma4hc22tbaa.cloudfront.net I'll 100% have to give that a shot! The other issue I'm seeing though is that will only work for full sitewide https encryption via config file, not via "use https for logins" because use https for logins still pulls from inline stylesheets. It works flawlessly when you use https for logins also. Though i also will like to see some improvements for https improvements. We should be able to define Nexus , Admin and Mod area under SSL for additional security. Link to comment Share on other sites More sharing options...
MGBrose Posted October 23, 2013 Author Share Posted October 23, 2013 It works flawlessly when you use https for logins also. Though i also will like to see some improvements for https improvements. We should be able to define Nexus , Admin and Mod area under SSL for additional security. I'll have to try it out then. It seems like Nexus is a really popular request in regards to https. Link to comment Share on other sites More sharing options...
bfarber Posted October 24, 2013 Share Posted October 24, 2013 There is already a setting to put (sensitive pages in) Nexus under SSL. " alt="2013-10-24_0839.png"> Link to comment Share on other sites More sharing options...
GreenLinks Posted October 24, 2013 Share Posted October 24, 2013 There is already a setting to put (sensitive pages in) Nexus under SSL. " alt="2013-10-24_0839.png"> It works , but many people should have ability to run nexus or admin cp under SSL if they choose to. Currently it is not possible to do so Link to comment Share on other sites More sharing options...
bfarber Posted October 25, 2013 Share Posted October 25, 2013 What do you mean by they are not able to run Nexus under SSL specifically? Are you meaning the entire software rather than just the sensitive pages? Link to comment Share on other sites More sharing options...
GreenLinks Posted October 25, 2013 Share Posted October 25, 2013 Are you meaning the entire software rather than just the sensitive pages? Yes Link to comment Share on other sites More sharing options...
bfarber Posted October 28, 2013 Share Posted October 28, 2013 Is there anything specifically in Nexus that should be under SSL but isn't when that setting is toggled to on? I'm not sure that MOST admins have any real need to enable fine-grained control of SSL on specific pages or applications. Most either want it completely on or off, or want it on for sensitive pages and off on regular pages (to help with efficiency). I think configuring SSL toggles in a granular fashion is overkill and confusing for most of our clients. Link to comment Share on other sites More sharing options...
GreenLinks Posted October 28, 2013 Share Posted October 28, 2013 Is there anything specifically in Nexus that should be under SSL but isn't when that setting is toggled to on? I'm not sure that MOST admins have any real need to enable fine-grained control of SSL on specific pages or applications. Most either want it completely on or off, or want it on for sensitive pages and off on regular pages (to help with efficiency). I think configuring SSL toggles in a granular fashion is overkill and confusing for most of our clients. It is actually for User Experience. Facebook also offers an option for end user to run whole site under https for additional security. Offering this can be very beneficial. Link to comment Share on other sites More sharing options...
bfarber Posted October 29, 2013 Share Posted October 29, 2013 It is actually for User Experience. Facebook also offers an option for end user to run whole site under https for additional security. Offering this can be very beneficial. This is different from what you suggested though (which was to allow all of Nexus to run under SSL or not). Offering to an end user the option to use the entire site under SSL or not is something we can/would consider separately. Link to comment Share on other sites More sharing options...
MGBrose Posted November 1, 2013 Author Share Posted November 1, 2013 This is different from what you suggested though (which was to allow all of Nexus to run under SSL or not). Offering to an end user the option to use the entire site under SSL or not is something we can/would consider separately. bfarber is offering an end user toggle to run the site under ssl possible via ipboard 3.4+ ? If so how would you create a toggle like this? Seeing a end user toggle would be an amazing feature/capability! Especially with all of the security/government snooping news lately. Link to comment Share on other sites More sharing options...
bfarber Posted November 4, 2013 Share Posted November 4, 2013 You would need a custom modification. It would be possible to do, but it's not something built in out of the box and subsequently isn't something I could just say "do this and this and it's there". Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.