{"action":"created","issue":{"url":"https://api.github.com/repos/haiwen/seafile/issues/1519","repository_url":"https://api.github.com/repos/haiwen/seafile","labels_url":"https://api.github.com/repos/haiwen/seafile/issues/1519/labels{/name}","comments_url":"https://api.github.com/repos/haiwen/seafile/issues/1519/comments","events_url":"https://api.github.com/repos/haiwen/seafile/issues/1519/events","html_url":"https://github.com/haiwen/seafile/issues/1519","id":130850056,"number":1519,"title":"Seafile redirects to an insecure connection when no URL path is provided","user":{"login":"multiwebinc","id":901732,"avatar_url":"https://avatars.githubusercontent.com/u/901732?v=3","gravatar_id":"","url":"https://api.github.com/users/multiwebinc","html_url":"https://github.com/multiwebinc","followers_url":"https://api.github.com/users/multiwebinc/followers","following_url":"https://api.github.com/users/multiwebinc/following{/other_user}","gists_url":"https://api.github.com/users/multiwebinc/gists{/gist_id}","starred_url":"https://api.github.com/users/multiwebinc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/multiwebinc/subscriptions","organizations_url":"https://api.github.com/users/multiwebinc/orgs","repos_url":"https://api.github.com/users/multiwebinc/repos","events_url":"https://api.github.com/users/multiwebinc/events{/privacy}","received_events_url":"https://api.github.com/users/multiwebinc/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2016-02-02T23:16:02Z","updated_at":"2016-02-09T00:38:21Z","closed_at":null,"body":"When trying to go to the domain with a secure connection it redirects to an insecure connection as long as no path is provided and the user is not logged in. For example:\r\n\r\n```\r\n$ curl -Ik https://seafile\r\nHTTP/1.1 302 FOUND\r\nDate: Tue, 02 Feb 2016 22:49:03 GMT\r\nServer: gunicorn/0.16.1\r\nTransfer-Encoding: chunked\r\nVary: Accept-Language,Cookie\r\nContent-Type: text/html; charset=utf-8\r\nLocation: http://seafile/accounts/login?next=/\r\nContent-Language: en\r\n```\r\n\r\nHowever, if I provide a path it does **not** redirect:\r\n\r\n```\r\n$ curl -Ik https://seafile/accounts/login/?next=/\r\nHTTP/1.1 200 OK\r\nDate: Tue, 02 Feb 2016 22:53:25 GMT\r\nServer: gunicorn/0.16.1\r\nTransfer-Encoding: chunked\r\nContent-Language: en\r\nExpires: Tue, 02 Feb 2016 22:53:25 GMT\r\nVary: Cookie,Accept-Language\r\nLast-Modified: Tue, 02 Feb 2016 22:53:25 GMT\r\nCache-Control: max-age=0\r\nContent-Type: text/html; charset=utf-8\r\n```\r\n\r\n```\r\n$ curl -Ik https://seafile/accounts/login/\r\nHTTP/1.1 200 OK\r\nDate: Tue, 02 Feb 2016 22:51:42 GMT\r\nServer: gunicorn/0.16.1\r\nTransfer-Encoding: chunked\r\nContent-Language: en\r\nExpires: Tue, 02 Feb 2016 22:51:42 GMT\r\nVary: Cookie,Accept-Language\r\nLast-Modified: Tue, 02 Feb 2016 22:51:42 GMT\r\nCache-Control: max-age=0\r\nContent-Type: text/html; charset=utf-8\r\n```\r\n\r\nIf the user is logged in, going to https://seafile will work correctly.\r\n\r\nHere is my Apache config:\r\n\r\n```\r\n<IfModule mod_ssl.c>\r\n        <VirtualHost *:443>\r\n                ServerAdmin webmaster@localhost\r\n                ServerName seafile\r\n\r\n                ProxyPass /seafhttp http://127.0.0.1:8082\r\n                ProxyPassReverse /seafhttp http://127.0.0.1:8082\r\n                RewriteRule ^/seafhttp - [QSA,L]\r\n\r\n                ProxyPass / http://localhost:8000/\r\n                ProxyPassReverse / http://localhost:8000/\r\n                ProxyPreserveHost On\r\n\r\n                Alias /media  /opt/seafile/seafile-server-latest/seahub/media\r\n\r\n                ErrorLog ${APACHE_LOG_DIR}/error.log\r\n                CustomLog ${APACHE_LOG_DIR}/access.log combined\r\n\r\n                SSLEngine on\r\n\r\n                SSLCertificateFile /etc/letsencrypt/live/mysite.com/fullchain.pem\r\n                SSLCertificateChainFile /etc/letsencrypt/live/mysite.com/chain.pem\r\n                SSLCertificateKeyFile /etc/letsencrypt/live/mysite.com/privkey.pem\r\n\r\n        </VirtualHost>\r\n</IfModule>\r\n```\r\n\r\nAn ugly hack is to redirect in Apache/Nginx to the https version, but that is not a viable solution since I believe a malicious user could still sniff the session cookie from the insecure request. Not to mention it is more inefficient since an extra request to the server must be made.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/haiwen/seafile/issues/comments/181643367","html_url":"https://github.com/haiwen/seafile/issues/1519#issuecomment-181643367","issue_url":"https://api.github.com/repos/haiwen/seafile/issues/1519","id":181643367,"user":{"login":"shoeper","id":5340585,"avatar_url":"https://avatars.githubusercontent.com/u/5340585?v=3","gravatar_id":"","url":"https://api.github.com/users/shoeper","html_url":"https://github.com/shoeper","followers_url":"https://api.github.com/users/shoeper/followers","following_url":"https://api.github.com/users/shoeper/following{/other_user}","gists_url":"https://api.github.com/users/shoeper/gists{/gist_id}","starred_url":"https://api.github.com/users/shoeper/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shoeper/subscriptions","organizations_url":"https://api.github.com/users/shoeper/orgs","repos_url":"https://api.github.com/users/shoeper/repos","events_url":"https://api.github.com/users/shoeper/events{/privacy}","received_events_url":"https://api.github.com/users/shoeper/received_events","type":"User","site_admin":false},"created_at":"2016-02-09T00:38:21Z","updated_at":"2016-02-09T00:38:21Z","body":"Have you restartet your server after adjusting the SERVICE_URL?"}}