indieweb / indieweb/indiewebify-me

Remove secure redirect check on entered URL for validate-rel-me?

Open
#91 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
CSS
Stars
188
Forks
26
PR merge metrics
No merged PRs in 30d

Description

I'm working on upgrading indiewebify.me to run on Symfony (#82). I found some code that does not appear to run correctly on the live site. I'm not sure why, but investigating it on the development site, I'm not sure it's needed anyway.

In the validate-rel-me step, the entered URL is normalized, fetched, and any redirects are followed, using [indieweb/rel-me relMeDocumentUrl()](https://github.com/indieweb/rel-me/blob/master/RelMe.php#L125). That function returns the final URL, a boolean of whether the redirect chain was secure, and an array of the redirect chain URLs.

Then this [if condition](https://github.com/indieweb/indiewebify-me/blob/master/web/index.php#L164) is supposed to show an error if the redirect chain was insecure. This is all before the final profile URL is parsed for rel-me values.

That if condition works on the Symfony site but does not appear to work on the live site. My site redirects http -> https, so if I enter http://gregorlove.com/, the error message shows and no rel-me URLs are parsed. This seems like a bad user experience. I can't think of a good reason to show an error like that but wanted to check if I'm forgetting something.

I think we only want to report scheme differences if the link back from a rel-me uses a different scheme, like:

```html

github
```

```html

example.com
```

The live site will show "link back is to http:// not https://" next to that rel-me link.

Is it safe to remove that if condition in the Symfony site I'm working on?

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reading web/index.php around line 164 and relMeDocumentUrl() in indieweb/rel-me/RelMe.php around line 125. Trace validate-rel-me with an HTTP-to-HTTPS redirect, then compare it with the rel-me link-back scheme check described in the issue. Done means the entered URL can proceed to rel-me parsing without the redirect-chain error while the link-back warning remains intact.

Written by the indexing model from the issue text.

Assessment

Tech stack
php, symfony
Domain
backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.