integreat-cms
integreat-cms copied to clipboard
digitalfabrik
HTTPS enforcement
Many users include images or other media from sites that do not use https. As a result, our website is marked as "non-secure" in the browser and in addition, this is a fairly high security risk.
~Since, from a practical point of view, we cannot completely prohibit users from embedding such content, we should take various soft measures that force users to https.~
Update 2021: Since meanwhile https is a very popular standard, it should be safe to completely forbid http content and use a hard enforcement here.
On the one hand, new content is problematic, but so is existing content. Therefore I suggest the following measures:
- The editor points out that the placement of such new content is very critical
- According to #46, such contents should not be packaged
- Pages, events, etc. with such content are marked in the corresponding list view
- There should be an additional list of all pages, events, etc. that have such content
I guess we can this in the nginx configuration by redirecting everything from HTTP to HTTPS? I don't see any need to implement this in Django.
Some users also include content from external sites that do not offer https. In this case the nginx configuration does not help us.
Oh sorry, I did not read carefully enough. Yes, this is a totally valid ticket.
We can use the broken link checker to evaluate whether a link can be accessed via HTTPS. This should probably also extended to foreign media sources (e.g. images).
I think the best (not-breaking) solution for now would be to add a new list to our link checker that shows all "Insecure Links":
That means we just need to add a new link in the menu and filter URLs that start with http://.
I think the best (not-breaking) solution for now would be to add a new list to our link checker that shows all "Insecure Links":
Good idea! I would even argue that this is a useful upstream contribution to https://github.com/DjangoAdminHackers/django-linkcheck. I opened https://github.com/DjangoAdminHackers/django-linkcheck/issues/149 there and see if I get feedback from the maintainer.
Update: insecure links are now marked in the "SSL" column:
What's missing however is that insecure links are marked as invalid. At the moment, they're still counted as valid links when the result is successful.