521242 - Recaptcha causes mixed-content SSL warnings on registration

Status: RESOLVED WONTFIX

(Websites Graveyard :: byob.mozilla.com, defect, P4)

Description

[Kev Needham [:kev]]

When loading the registration page, users are presented with the warning that some items in the page are not encrypted. This causes a "broken padlock" warning, and may also cause concern that the information being sent, which is personally identifiable, may not be encrypted between the client and webapp.

The warning appears to be caused by the reCAPTCHA code, and can be corrected by switching to the encrypted API as outlined at http://recaptcha.net/apidocs/captcha/client.html in the "Using reCAPTCHA on an https site" section. Could the registration page please be changed to use the https API to ensure all items in the page are delivered via https?

Steps to reproduce:

- Use a browser that has SSL warnings enabled
- Navigate to https://byob.mozilla.com/register
- A mixed-content message, warning the user that some items were not delivered securely, is displayed.

Comment 2

[Reed Loden [:reed]]

Attachment: patch - v1

Comment 3

[Les Orchard [:lorchard]]

Comment on attachment 406961 [details] [diff] [review]
patch - v1

This patch forces SSL for Recaptcha at the helper level, rather than the app level.

I've got a patch from ozten on another project that adds an SSL flag as a parameter to the helper, so I'll probably end up using that

Comment 4

[Les Orchard [:lorchard]]

Pushing into my bug queue.

Comment 5

[Les Orchard [:lorchard]]

Fixed in r62100

Comment 6

[Carsten Book [:Tomcat]]

verified fixed !

Comment 7

[Mark Goodwin [:mgoodwin]]

byob appears to be serving reCAPTCHA scripts over http again.

Comment 8

[Mark Goodwin [:mgoodwin]]

Also, the video on the front page is not served over TLS; this causes mixed content warnings in some browsers regardless of whether or not the browser uses the object: http://www.mozilla.com/includes/flash/playerWithControls.swf?flv=firefox/3.6/whatsnewin36.mp4&autoplay=false&msg=Play%20Video

Comment 9

[Carsten Book [:Tomcat]]

ups, byob is long dead, so marking wontfix