(logged out user) is problematic (example: the registry)
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	pdehaye
	Oct 27 2019, 12:40 PM

Description

When I am logged in on the wikibase registry, and click on the link https://wikibase-registry-query.wmflabs.org/embed.html#SELECT%20%3Fitem%20%3FitemLabel%20%3Ffeature%20%3FfeatureLabel%20%3Fneed%20%3FneedLabel%0AWHERE%0A%7B%0A%20%20%20%20%3Fitem%20wdt%3AP11%20%3Fclass.%0A%20%20%20%20VALUES%20%3Fclass%20%7Bwd%3AQ62%20wd%3AQ20%7D%0A%09SERVICE%20wikibase%3Alabel%20%7B%20bd%3AserviceParam%20wikibase%3Alanguage%20%22%5BAUTO_LANGUAGE%5D%2Cen%22%20%7D%0A%20%20%20%20%3Fitem%20wdt%3AP18%20%3Fneed%0A%7D%0ALIMIT%20100
I end up with query results http://..... (not https). When clicking on it, I end up on http://..... and I am logged out. I don't think this is appropriate.

This is a frequent problem with new wikibase installs.

Related Objects

Mentioned In: T236766: QueryService UI, allow linking to concept URIs via https even when the concept URI is http
Mentioned Here: T236766: QueryService UI, allow linking to concept URIs via https even when the concept URI is http

Event Timeline

pdehaye created this task.Oct 27 2019, 12:40 PM

Restricted Application added a project: Wikidata. · View Herald TranscriptOct 27 2019, 12:40 PM

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Addshore added a project: Wikibase-registry.Oct 29 2019, 10:05 AM

Addshore mentioned this in T236766: QueryService UI, allow linking to concept URIs via https even when the concept URI is http.

I think the Query service UI should have the ability to link to concept urIs using a https source (if configured) even if the concept URI is http.

I created T236766 for that idea.

I think the actual issue here will be a mediawiki config issue on the registry, or rather the web server should be configured to redirect http to https always.
In chrome I can't actually navigate to the registry using http

Addshore moved this task from incoming to monitoring on the Wikidata board.Oct 29 2019, 10:08 AM

I wonder at what level the HSTS needs to be done. In the webservers in the docker images (which don't handle the https) or in the labs proxy that this stuff routes though?

I don't appear to be able to reproduce this issue any more
I imagine something got changed around http https and redirects wtc in labs / cloudvps

Restricted Application added a project: User-Addshore. · View Herald TranscriptJun 21 2021, 7:36 AM

The round-trip (logged in user) --> query service --> (logged out user) is problematic (example: the registry)Closed, ResolvedPublicActions

Description

Related Objects

Event Timeline

The round-trip (logged in user) --> query service --> (logged out user) is problematic (example: the registry)
Closed, ResolvedPublic
Actions