701665 - (wh-6875897) twitter profile image causes mixed content condition on support

Status: VERIFIED FIXED

(support.mozilla.org :: Army of Awesome, task, P1)

Description

[Mark Goodwin [:mgoodwin]]

Issue:
Twitter profile images are served over HTTP when the rest of the page is served over HTTPS; this causes browsers to issue mixed content warnings and desensitises users to security warnings on mozilla sites.

Steps to reproduce:
1) Visit https://support.allizom.org/en-US/army-of-awesome?twitter_auth_request=1
2) View source
3) Observe img elements with src attribute set to non HTTPS URL

Resolution:
Is it possible to source the twitter profile images an HTTPS URL?

Comment 1

[Mark Goodwin [:mgoodwin]]

It would appear that twitter do serve profile images securely for their own pages; I don't know if there's a supported way for others to do this.

Comment 2

[James Socol [:jsocol, :james]]

If the URL for the images doesn't change, except in the protocol, we can probably put protocol-relative URLs there.

Comment 3

[Ricky Rosario [:rrosario, :r1cky]]

Twitter doesn't seem to support https on their {a0,a1,a2,...}.twimg.com domain. But the Twitter API has a nice endpoint that supports https and http:
https://api.twitter.com/1/users/profile_image/<username>

A protocol-relative URL should work with that \o/

Comment 4

[Ricky Rosario [:rrosario, :r1cky]]

Snap, the documentation [1] says:

"This method should only be used by application developers to lookup or check the profile image URL for a user. This method must not be used as the image source URL presented to users of your application."


https://dev.twitter.com/docs/api/1/get/users/profile_image/%3Ascreen_name

Comment 5

[Ricky Rosario [:rrosario, :r1cky]]

Turns out that the API also has a 'profile_image_url_https' field in the JSON response for each tweet.

https://github.com/mozilla/kitsune/commit/85ca508f61a117cdfc284b19e2316a1dd7fefad3

Comment 6

[Will Kahn-Greene [:willkg] ET needinfo? me]

These bugs are all resolved, so I'm removing the security flag from them.