indieweb / indieweb/indiewebify-me
Remove secure redirect check on entered URL for validate-rel-me?
- Dominant language
- CSS
- Stars
- 188
- Forks
- 26
- PR merge metrics
- No merged PRs in 30d
Description
I'm working on upgrading indiewebify.me to run on Symfony (#82). I found some code that does not appear to run correctly on the live site. I'm not sure why, but investigating it on the development site, I'm not sure it's needed anyway.
In the validate-rel-me step, the entered URL is normalized, fetched, and any redirects are followed, using [indieweb/rel-me relMeDocumentUrl()](https://github.com/indieweb/rel-me/blob/master/RelMe.php#L125). That function returns the final URL, a boolean of whether the redirect chain was secure, and an array of the redirect chain URLs.
Then this [if condition](https://github.com/indieweb/indiewebify-me/blob/master/web/index.php#L164) is supposed to show an error if the redirect chain was insecure. This is all before the final profile URL is parsed for rel-me values.
That if condition works on the Symfony site but does not appear to work on the live site. My site redirects http -> https, so if I enter http://gregorlove.com/, the error message shows and no rel-me URLs are parsed. This seems like a bad user experience. I can't think of a good reason to show an error like that but wanted to check if I'm forgetting something.
I think we only want to report scheme differences if the link back from a rel-me uses a different scheme, like:
```html
github
```
```html
example.com
```
The live site will show "link back is to http:// not https://" next to that rel-me link.
Is it safe to remove that if condition in the Symfony site I'm working on?
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reading web/index.php around line 164 and relMeDocumentUrl() in indieweb/rel-me/RelMe.php around line 125. Trace validate-rel-me with an HTTP-to-HTTPS redirect, then compare it with the rel-me link-back scheme check described in the issue. Done means the entered URL can proceed to rel-me parsing without the redirect-chain error while the link-back warning remains intact.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php, symfony
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100