Call to arms - SSL

Question

For anyone who is reading this and is interested in helping out. We will slowly move towards https only at Project-GC.com. In the end we will use a redirect (301) when requesting http://project-gc.com/, and forward it to https://project-gc.com/. But first there are a few things we would like to make sure of.

1. Is there any part of Project-GC that does not work when using https?
2. Is there any place at Project-GC that links itself using http instead of https?
3. We would also like to always link Geocaching.com and coord.info using https (instead of http).

If you find anything that doesn't comply with the above three items, feel free to post the information here so that we can fix it.

This week we have installed new certificates for the site, since the old ones were close to expire. We have also switched to a new CDN that has better certificate handling.

Besides the fact that it's securer for everyone, this is starting to be a requirement with all the web browser restrictions. It's about time we update. But as always, time is an issue for us.

Please ignore Profile stats if the "data from" isn't at least 2017-08-17. This is due to the fact that we are caching the html for those. They might be rendered before our most recent changes.

Comments

The "Return to Project-GC" on this page links without https

---

Thanks. That was a great place to start. :)

Answer 1

On the Profile Stats Page:  All GC (coord.info) links are http:  on each of the tabs

On the Badgegen page:  The link at the bottom is http:   Statistics produced with Project Geocaching

The geocaching.com link here:

The below statistics can be downloaded as a static HTML file that then can be uploaded as a public profile on Geocaching.com. Download the HTML by clicking the button below, then go to Geocaching.com Edit Profile and paste the html there. Creating the html might take a minute.

Comments

Your Profile stats probably was rendered, and (data-)cached before we made our changes. I do believe we have fixed all/most of those cases.

As a tested I forced a new render of my own Profile stats. I checked the "produced with" -link and some of the coord.info links. All those seems correct.

Since Profile stats is cached as html blobs we should ignore those if the "data from" doesn't say 2017-08-17 or newer (tomorrow. I will update my original post.

---

Verified the newly generated stats are correct.

The Geocaching.com Edit Profile link is still http.

---

The GC Codes within the Virtual GPS are http.  I tried creating a new Virtual GPS list to ensure it was not a caching issue.

---

@jajakeiz
Confirmed. A small fix has been applied in our development environment. Will hold on to releasing it since it's not really critical.

Answer 2

On the statbar page, some of the BBCodes given to paste into your profile quote http, not https.

On the stats page, the link to hide your profile stats is also http. Scrub that one - must have been a caching issue.

Comments

This is still an issue. I find several http:// linkes on https://project-gc.com/Profile/Statbar and get a mixed content warning.

Answer 3

I have run on of my SEO tools on your site and found the following urls:

http://project-gc.com/images//country_flags2/png/au.png
http://project-gc.com/images/geocaching-live/Geocaching_Authorized_Developer_vFINAL_090816_300.png
http://project-gc.com/images/logo_gc_4.png
http://project-gc.com/images/showroom/ChallengeCheckers-Result-5.png
http://project-gc.com/images/showroom/Maps-HiddenMonthsWithinDistance.png
http://project-gc.com/images/showroom/ProfileStats-Finds-ByFP-ByOldest-ganja1447-150605.png
http://project-gc.com/images/showroom/ProfileStats-Finds-FindsByDifficultyTerrain-ganja1447-150605.png
http://project-gc.com/images/showroom/ProfileStats-Finds-PieCharts-ganja1447-150605.png
http://project-gc.com/images/showroom/ProfileStats-Hides-3-ganja1447-150605.png
http://project-gc.com/images/showroom/ProfileStats-Milestones-FirstCacheByCountryType-ganja1447-150605.png
http://project-gc.com/images/showroom/TopLists-T5cachesPerRegion-Sweden.png
http://project-gc.com/images/showroom/TopLists-TopDTLoopers_thumb.png
http://translate.project-gc.com/

Comments

It's a bit hard to know where those are linked from by just running a tool. I can not find the geocaching-live -logo using http when I use https for example. Seems like your tool didn't only use the site with SSL. In some cases Project-GC will serve with the current used protocol, which is all fine.

Same with the showroom-images. Those are https for me when using https.

I can find a few links to translate.project-gc.com though. I will fix those, even though it's just a cname to Crowdin.

Answer 4

In partial answer to my post from yesterday (http://project-gc.com/qa/?qa=14834/blank-icons-in-maps-missing-cache-types) if I open the maps from the Tools menu almost all cache icons come up blank (no cache type indicated).

If I manually change the URL to "https" from "http" the icons appear normal.
I had to change my initial bookmark for Project-gc.com from "http:" to "https:" for the links to open as secure and work correctly.

Comments

I made an answer to your question in your thread instead. I do believe it will be solved by a hard refresh of your web browser.

---

Changing the main bookmark URL fixed it, I am however still missing (blank fields) on my stats page:

Cumulative finds by month
Finds by year cache placed
Finds to 16th Aug for each year

Shift/F5 didn't make a difference, not sure if it's related to SSL or not but they've been missing since yesterday.

---

Those could be because the servers has been overloaded and a faulty result has been stored. If it doesn't solve itself when the "data from" in the header updates, please make a support ticket with us so that we can look into it for real. I assume it will solve itself on the next render though. Our current load is higher than usual but not that high, we don't expect any issues due to load any more.

I had at least one image in my Profile stats that went quite broken as well. The first one in the first top. I had 0-2 finds every year since year 2000, instead of my 2000-3000 per year since 2010.

---

Strangely, when I look at my public profile/about on Geocaching.com the Cumulative finds by month shows up with the same current date (data from 2017/8/16) as PCG but when I open in on PGC it's blank. I'll open a ticket if the fields don't show up in a day or two. Thanks ganja1447!

Answer 5

I did not have a problem by clicking the link with https
All my functionality seems to work correctly with https link
I opened all the tabs that open directly in https

traduit du francais par google

je n'ai pas eu de probléme en cliquant le lien avec https
toutes mes fonctionalités semble fonctionner correctement avec lien https
j'ai ouvert tous les onglets qui ouvrent direct en https

Answer 6

If you are running *nix servers, I recommend the following command:

find (root folder) -exec grep http: {} /dev/null \; 2>/dev/null

This will find any instances of the string http: in any file under that root folder.

Comments

It's not that easy actually. There are over 4000 hits in the PHP code alone, not counting JS. Some of it from external services like the forum-engine for example. With some grep and so one it can be minimized, but the fact is that not all http-links should be changed.

This was however how we started, glancing through it. But going through every single match systematically would be a huge work effort.