3
\$\begingroup\$

I noticed today that on chat a link only previews when using a non-secure version like:

This is what it looks like when both lines are entered subsequentially in chat: Wikipedia preview

I noticed this before, but until now wasn't able to put my finger on the actual problem. In my opinion this is a bug. What do I need to do to get this fixed?

\$\endgroup\$
  • 1
    \$\begingroup\$ It's probably a security system that prevents bots from accessing https sites (just guessing) \$\endgroup\$ – clabacchio Jan 13 '13 at 22:12
2
\$\begingroup\$

Chat was still looking for the old-style Wikipedia HTTPS links (https://secure.wikimedia.org/wikipedia/...), so it just didn't recognize that the link was a Wikipedia link. From the next build of the chat system on, the new-style links (which are much saner anyway) will be recognized.

\$\endgroup\$
0
\$\begingroup\$

This behavior is fundamental to the way secure HTTP (HTTPS) operates:

The HTTPS "security envelope" specifies a specific closed, protected and encrypted path between the certified server (server certificate), and the session-specific identified client, your browser, which self-certifies for the purpose of completing this loop.

If an https://... URL needed to be displayed as a preview in chat, that would mean that the chat server is identifying itself to the secure server hosting the https site, your browser is not the authorized "consumer" of this secure circuit.

While a server-side script could be written to access secure sites and display them unsecured, acting as a proxy, this would (a) violate the very rationale of a secure connection, and (b) permit the bypassing of server security thus allowing unauthorized viewers to access the secure site that may be restricted to the actual client of the chat site.

This is not to say that this is not done - From way back in the history of web browsers, there have been proxy sites that have done this.

Further, one method that has been used to protect the security envelope and yet provide the content of a secure site within an unsecured (or separately identified / certified) server's content, is the use of iFrames or the like, essentially a browser control embedded within the browser page. If the end browser does not have authority to access the secure site, the iFrame would thus display a blank block or an error message. Not elegant in a chat, of course.

\$\endgroup\$
  • \$\begingroup\$ Sorry, but this answer makes very little sense. All oneboxes, including Wikipedia ones, are downloaded, processed and rendered on the server, not on the client. Part (a) of your fourth paragraph is really not an issue when you're not doing more than showing a little preview of a publicly accessible page; part (b) I don't even understand what you're saying -- why would the server ever have access to something on Wikipedia that the client doesn't? And, again, we're talking about a public website here anyway. \$\endgroup\$ – balpha Jan 23 '13 at 9:34
  • \$\begingroup\$ @balpha Don't worry about it. \$\endgroup\$ – Anindo Ghosh Jan 23 '13 at 9:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .