398239 - HTTPS should be used for sensitive info pages (login, register, etc.)

Status: VERIFIED FIXED

(support.mozilla.org :: Knowledge Base Software, task)

Description

[Reed Loden [:reed]]

Right now, http://support.mozilla.com/kb/tiki-register.php and http://support.mozilla.com/kb/tiki-login_scr.php are on HTTP (non-SSL), which means anybody monitoring the networking traffic between a user's computer and the server running support.mozilla.com can easily sniff the user's password. HTTPS (SSL) should be used on any sensitive pages such as register, login, etc. to prevent this.

Comment 1

[Michael Morgan [:morgamic]]

This is known.  The app needs refactoring to support this on the register/edit/login pages.  It's on my TODO list.

I assume you already filed a bug against wikimo?

Comment 2

[Reed Loden [:reed]]

(In reply to comment #1)
> I assume you already filed a bug against wikimo?

Of course. Bug 397125.

Other related bugs:
* Bug 269012
* Bug 390836
* Bug 395540
* Bug 396008
* Bug 397123

Comment 3

[Michael Morgan [:morgamic]]

Here's your gold star.

Comment 4

[Nelson Ko [:nkoth]]

morgamic,

What exactly needs to be done here? Perhaps I can help?

Comment 5

[Laura Thomson :laura]

morgamic, should I reassign this?

Comment 6

[Michael Morgan [:morgamic]]

We basically just need to require SSL on the login page.

Comment 7

[Laura Thomson :laura]

I think it would be better if we then required SSL both on the login page and once a user was logged in, to avoid MITM attacks.  

Comment 8

[Laura Thomson :laura]

I note Tiki has an admin setting to require HTTPS login - we can turn this on in the next maintenance window.  Nelson, will that do the trick, or is there more we need to do?

Comment 9

[Laura Thomson :laura]

Having some problems on support-stage with HTTPS which blocks testing  (bug 452802)...let's hold this over to 0.6.4, although we may be able to do it sooner since it's basically just a setting change.

Comment 10

[Laura Thomson :laura]

Testing with this on support-stage shows there's a bug somewhere - when you turn on required https login in tiki login redirects you to tiki-login.php instead of tiki-login_scr.php.  Looks like we'll need a code change instead.

Comment 11

[Nelson Ko [:nkoth]]

I think redirect to tiki-login.php instead of tiki-login_scr.php is intended and desired to effect login.

It looks like https://support-stage.mozilla.org/...anything... (e.g. https://support-stage.mozilla.org/en-US/kb) 404s though, and https://support-stage.mozilla.org/ redirects to http://www.mozilla.org/

Comment 12

[Laura Thomson :laura]

Reassigning to nelson after IRC discussion, thanks Nelson.

Comment 13

[Nelson Ko [:nkoth]]

Can someone tell my why the following statement resolves to false on support-stage.mozilla.org even if I submit a https request?


if ( isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on'     || $_SERVER['SERVER_PORT'] == 443 )

Comment 14

[Wil Clouser [:clouserw]]

If it's behind the netscaler the SSL is being offloaded before it hits your script.  Not sure if it's a global setting on the netscaler but it sets HTTP_MOZ_REQ_METHOD on AMO.  If it's setting it for you too, something like this in your init file should fix it:

if (isset($_SERVER['HTTP_MOZ_REQ_METHOD']) && $_SERVER['HTTP_MOZ_REQ_METHOD'] == 'HTTPS') {
    $_SERVER['HTTPS'] = 'on';
}

Comment 15

[Reed Loden [:reed]]

or IT can just add |SetEnv HTTPS on| to the vhost... we've done that before.

Comment 16

[Nelson Ko [:nkoth]]

Attachment: https support behind netscalar

This patch is already in the current trunk (r20736). Will commit to production after reviewed.

Actual https requirement must be set to "Require SSL" in the TikiWiki admin panel in admin...login.

Default has been set for user not to stay in SSL after logging in. If anyone disagrees with this, I can change the default behavior to "Stay in ssl".

Comment 17

[Laura Thomson :laura]

Comment on attachment 352505 [details] [diff] [review]
https support behind netscalar

This all looks fine.  Let's test/verify it extensively on support-stage though (stephend ftw!)

Comment 18

[Nelson Ko [:nkoth]]

Comment on attachment 352505 [details] [diff] [review]
https support behind netscalar

in r20738 in production. Will be in effective after turning on, after push.

Comment 19

[Stephen Donner [:stephend] Not actively reading bugmail]

(In reply to comment #17)
> (From update of attachment 352505 [details] [diff] [review])
> This all looks fine.  Let's test/verify it extensively on support-stage though
> (stephend ftw!)

Added bug 469095 and 469096 to the dependency list.

Comment 20

[Stephen Donner [:stephend] Not actively reading bugmail]

OK; verified fixed.  Bug 469095 and bug 469096 are scoped post-release, accordingly.

Comment 21

[Marc Laporte]

All this part was rewritten by nyloth. Need to check if new method is suitable for SUMO.