Seeking geek for forum

[alrock]

Well, the forum software has another glitch that I can't figure out so I'm hoping to obtain a bit of assistance from the forum members. Currently, the Garage is not working correctly and it actually logging people out when you use it. The Garage is a vBulletin (forum software) add-in that the original developers abandoned many years ago so it has not been supported or updated since about the time we started this forum. So we know that software did not change and create this issue.

The forum software hasn't been updated in about a year, so that's not a likely culprit.

My two guesses are either browser security changes or back-end changes by our hosting service to which I am not aware. I'm happy to ask them if they changed anything, but if anyone has more detailed questions to ask other than "Did anything change?" that would be helpful.

One thing I noticed is that the garage links are all non-secure http: whereas the forum is using https: Could that be an issue?

Hopefully someone can lend some time or expertise to fix this H4O feature.

Thanks,
Alex

 

[JPaul]

With a cursory glance I see that the link to the Garage is HTTP instead of HTTPS and when you follow it you're not logged in. However I remain logged in if I go back to the forums. Also, if you change the address for the garage from http://www.hummer4x4offroad.com/forum/garage.php to https://www.hummer4x4offroad.com/forum/garage.php then everything appears to be fine, you're also logged back in again.

This appears to be due to a browser security measure where if the cookie it receives (such as for login authorization) is received over a HTTPS connection, then it won't allow it to be resent over a non-secure connection. All the URL's for the Garage are non-secure for some reason, even after manually switching it to HTTPS, so it looks like if you can get that bit fixed (might be a setting in the admin that needs to be changed?) then everything should start working again.

 

[SlcHummer]

Doubt it is related but there used to be a similar issue when accessing H40 through a Google search which would direct you to an http link, https://www.hummer4x4offroad.com/forum/showthread.php/13609-Failed-logins-using-HTTP-links.

 

[alrock]

I believe that previous issue was resolved.

 

[H3V8]

I believe that previous issue was resolved.

You're able to access the site starting with either "http" or "https" still. I can go to the URL bar, change https to http and still access the site, defeating the purpose of the SSL encryption. You'll still need to force redirect all traffic from http to https. This is usually done with the ".htaccess" file found/created in the root webserver directory (such as /var/www/html).

The contents of the .htaccess file may look something like this which forces all traffic from http -> https.

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

I would start with forcing all http traffic to https first to see if that helps the garage issue.

EDIT: The following may be helpful as well: https://www.ostraining.com/blog/coding/find-htaccess/