@ IOhannes
in my case the fix works: no security warning anymore.
great service rolf
IOhannes m zmoelnig schreef op 22-10-2024 9:50:
On 10/21/24 12:53, IOhannes m zmoelnig wrote:
maybe, i'll implement something (there's already <https://git.iem.at/ zmoelnig/deken-server/-/issues/7>), but i have no ETA.
i think i've fixed the issue now: whenever you access deken.puredata.info via https, you will now also get https:// links to the packages, so the security warning should now be void.
i also think i now know what caused the disturbance in the first place: about a month ago or so, our security adviser told me to tighten up security on our webservices. one of the things that changed is that we know use an HSTS header, indicating that browsers should always use https:// to access deken.puredata.info (while at the same time, allowing the content to be served over http://, so Pd/deken is still happy). usually these headers are served over https:// (preventing a connection downgrade to http://), but we are using them on the http:// connection as well (nudging the browser to upgrade to https://)
long story short: i think we know have a working solution that uses https:// (both for searching an downloading) whenever possible, but still allows http:// access for legacy clients.
gfadmsr IOhannes
pd-list@lists.iem.at - the Pure Data mailinglist https://lists.iem.at/hyperkitty/list/pd-list@lists.iem.at/message/6HKM4M52IV...
To unsubscribe send an email to pd-list-leave@lists.iem.at mailing list UNSUBSCRIBE and account-management -> https://lists.iem.at/