iso.qa.ubuntu.com renders differently under HTTPs - http assets not loaded over https

[Marco Parillo]

I would prefer to use https://iso.qa.ubuntu.com/, but it seems as if http://iso.qa.ubuntu.com/ renders better for me under both Falkon and Chromium.

Marking this as security as HTTPs should be "normal".

[Jean-Baptiste Lallement (jibel)]

Thanks for your report.

It's because the CSS are on http instead of https and not loaded in this case.

[Dimitri John Ledkov (xnox)]

@jibel

Not quite, the resources are there on the same host and served both under http & https.

If I go into inspector, and change the urls to https, the page renders correctly.

It is a security policy that browsers do not load http resources from an https page.

It seems like https got enabled on the qatracker app, without changing the settings such that it too knows that it is available over https. If that is done, then it would correctly render https urls for the resources, and everything should work correctly under https.

Thus this is a deployment issue, but I don't know where the production deployment settings are.

[Dimitri John Ledkov (xnox)]

Depending on how drupal is configured either baseurl needs to be set, or dynamically rewritten, or a content header to upgrade requests needs to be set.

See https://www.drupal.org/project/securelogin/issues/1670822 for many available solutions.

[Nicolae Crefelean (kneekoo)]

https://enable-cors.org/server_apache.html

^ This doesn't give you the solution, but where you should look. Ideally, the CORS settings are not in .htaccess (for performance reasons), but it should be in one of those places.