903691 - Load demos (all or some) through HTTP rather than HTTPS

Status: RESOLVED WONTFIX

(developer.mozilla.org Graveyard :: Demo Studio / Dev Derby, enhancement)

Description

[John Karahalis [:openjck]]

What did you do?
================
Load the following two demo landing pages, then hit "Launch Demo" on each.

* https://developer.mozilla.org/en-US/demos/detail/falling-in-circles
* https://developer.mozilla.org/en-US/demos/detail/running-image-triangulation-and-extrusion

What happened?
==============
Demos have errors because they were loaded over HTTPS.

What should have happened?
==========================
Demos should work correctly, as they do when loaded over HTTP.

Is there anything else we should know?
======================================
We have run into this issue a number of times before, but it has been especially problematic lately. Can we load demos over HTTP, or at least offer some way of doing this conditionally?

As it stands, Dev Derby users are seeing broken demos when not strictly necessary, and are missing out on some really incredible ones as a result.

Comment 1

[Les Orchard [:lorchard]]

I don't see an issue with either of those demos - they load and run fine for me. Can you specify the browser & version under which you were seeing issues? (Mine is Firefox 22.0 on OS X)

As for serving up with HTTP, it looks like the CDN will do it:

    http://developer.cdn.mozilla.net/media/uploads/demos/r/o/rossmckegney/0e2e691e2d9617d5566e52eb1dfdd0b0/falling-in-circles_1371497189_demo_package/index.html

    http://developer.cdn.mozilla.net/media/uploads/demos/w/i/wizgrav/f232e401f674086f9aae99b474e27ed0/running-image-triang_1372626220_demo_package/index.html

But, MDN is HTTPS-only, so demos served up with http will not work with the iframe'd nav bar due to mixed content restrictions. 

Switching MDN itself over to HTTP-only or even HTTPS-optional is a larger discussion in bug 783685

Comment 2

[Les Orchard [:lorchard]]

(And also bug 671794, since bug 783685 got RESOLVED DUPLICATE)

Comment 3

[Les Orchard [:lorchard]]

And, since I can't reproduce issues with either of those demos - can you elaborate? Any errors in particular? What specifically failed, and what led you to believe HTTPS was the culprit?

Comment 4

[John Karahalis [:openjck]]

I am using Firefox 23 / Linux. I bet this has something to do with the mixed-content changes Firefox 23 introduced.

The errors do not come from the browser, but rather the demo. I get warnings like "Did you forget to enable API access on the project?", etc. I know that HTTPS is the culprit (or at least, am very confident that HTTPS is the culprit) because the demos load fine when loaded over HTTP.

Comment 5

[John Karahalis [:openjck]]

From one of the demo authors...

> It worked fine in Firefox 22.0 (Mac), but when I updated to 23.0 I see the same error you do.

Comment 6

[Les Orchard [:lorchard]]

I just upgraded to Firefox 23, and see an error on the "falling-in-circles" demo.

It looks like the problem is that the demo is attempting to fetch HTTP resources from assets.verold.com. So, yes, that's a mixed-content issue - but actually I think this failure is working-as-intended.

In general, demos uploaded to Demo Studio need to be self-contained. That is, they should only fetch resources relative to the contents of the .zip file that we unpack and host on our CDN. Otherwise, we can't guarantee that they'll work (whether served up from HTTP or HTTPS).

We've made some exceptions for demos that need an off-site web sockets server, but other than that they need to be standalone collections of resources.

Comment 7

[Les Orchard [:lorchard]]

For "running-image-triangulation-and-extrusion" on Firefox 23, I get this error on some but (not all) of the images, regardless of whether it's been served up from either HTTP or HTTPS:

  NS_ERROR_NOT_AVAILABLE: component is not available

I think HTTP vs HTTPS is a red herring in that demo's case

Comment 8

[John Karahalis [:openjck]]

On that demo, notice that clicking the images (top of the viewport) has an effect over HTTP but not HTTPS.

Comment 9

[Les Orchard [:lorchard]]

(In reply to John Karahalis [:openjck] from comment #8)
> On that demo, notice that clicking the images (top of the viewport) has an
> effect over HTTP but not HTTPS.

Oh which demo - the "running-image..." demo? Whether served up via HTTP or HTTPS, what I notice is that I get errors either way.

Comment 10

[Les Orchard [:lorchard]]

(In reply to Les Orchard [:lorchard] from comment #9)
> (In reply to John Karahalis [:openjck] from comment #8)
> > On that demo, notice that clicking the images (top of the viewport) has an
> > effect over HTTP but not HTTPS.
> 
> Oh which demo - the "running-image..." demo? Whether served up via HTTP or
> HTTPS, what I notice is that I get errors either way.

For example, clicking the first image after loading the demo from HTTP (*not* SSL), I get the error:

http://dl.dropboxusercontent.com/u/2798055/Screenshots/nhqG.png

Comment 11

[John Karahalis [:openjck]]

The Running Image demo, yeah. The error you mention may persist regardless of protocol, but when I reported this bug I was only able to use the demo over HTTP (where "use" means that by clicking Mario, a bigger Mario appears in the center of the screen) . But now, it seems I am occasionally able to use this demo over HTTPS, and occasionally /un/able to use it over HTTP. So it's working may be unrelated to HTTP/HTTPS.

But the Falling in Circles demo does still only work over HTTP.

Comment 12

[Les Orchard [:lorchard]]

(In reply to John Karahalis [:openjck] from comment #11)

> But the Falling in Circles demo does still only work over HTTP.

Yes, I know - see Comment #6

Comment 13

[ali spivak]

Demo Studio is being removed from MDN and archived as of end January 2016