{"action":"created","issue":{"url":"https://api.github.com/repos/instructure/canvas-lms/issues/1093","repository_url":"https://api.github.com/repos/instructure/canvas-lms","labels_url":"https://api.github.com/repos/instructure/canvas-lms/issues/1093/labels{/name}","comments_url":"https://api.github.com/repos/instructure/canvas-lms/issues/1093/comments","events_url":"https://api.github.com/repos/instructure/canvas-lms/issues/1093/events","html_url":"https://github.com/instructure/canvas-lms/issues/1093","id":249479026,"node_id":"MDU6SXNzdWUyNDk0NzkwMjY=","number":1093,"title":"Canvas loads image over http even when loaded over https","user":{"login":"newperson1746","id":19787725,"node_id":"MDQ6VXNlcjE5Nzg3NzI1","avatar_url":"https://avatars3.githubusercontent.com/u/19787725?v=4","gravatar_id":"","url":"https://api.github.com/users/newperson1746","html_url":"https://github.com/newperson1746","followers_url":"https://api.github.com/users/newperson1746/followers","following_url":"https://api.github.com/users/newperson1746/following{/other_user}","gists_url":"https://api.github.com/users/newperson1746/gists{/gist_id}","starred_url":"https://api.github.com/users/newperson1746/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/newperson1746/subscriptions","organizations_url":"https://api.github.com/users/newperson1746/orgs","repos_url":"https://api.github.com/users/newperson1746/repos","events_url":"https://api.github.com/users/newperson1746/events{/privacy}","received_events_url":"https://api.github.com/users/newperson1746/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2017-08-10T21:15:50Z","updated_at":"2018-08-17T16:17:15Z","closed_at":"2017-10-13T23:04:08Z","author_association":"NONE","body":"### Summary:\r\nWhile using canvas (loaded over https), and after logging in, a certain image (/images/messages/avatar-50.png) is loaded over http, and viewing the source of the generated html page confirms that the image url uses http.\r\n### Steps to reproduce:\r\n\r\n 1. Login to canvas with any username\r\n 2. Notice that there is no green secure bar in google chrome (and there is a gray i to tell you that not all resources were loaded securely), or that there is no lock in safari, even though they both show their respective \"100% loaded with https\" icon in the login page.\r\n 3. Confirm that the image was loaded over http by checking the html source and finding the url\r\n \"img src=\"http://(url-to-canvas)/images/messages/avatar-50.png\" alt=\"Admin\" /> or using the chrome developer console and looking for the warning \"Mixed Content: The page at XXXX was loaded over https, but requested an insecure image '<image_url>'\"\r\n\r\n### Expected behavior:\r\nAll page resources are loaded via https, and browsers show the appropriate icon indicating that all resources were loaded securely.\r\n### Additional notes:\r\nI am running canvas on macOS Sierra 10.12.3 with ruby 2.4.1, passenger 5.1.7, and nginx 1.13.3 compiled from source. ssl: true is specified in domain.yml under production."},"comment":{"url":"https://api.github.com/repos/instructure/canvas-lms/issues/comments/413916051","html_url":"https://github.com/instructure/canvas-lms/issues/1093#issuecomment-413916051","issue_url":"https://api.github.com/repos/instructure/canvas-lms/issues/1093","id":413916051,"node_id":"MDEyOklzc3VlQ29tbWVudDQxMzkxNjA1MQ==","user":{"login":"juniorb2ss","id":3980385,"node_id":"MDQ6VXNlcjM5ODAzODU=","avatar_url":"https://avatars0.githubusercontent.com/u/3980385?v=4","gravatar_id":"","url":"https://api.github.com/users/juniorb2ss","html_url":"https://github.com/juniorb2ss","followers_url":"https://api.github.com/users/juniorb2ss/followers","following_url":"https://api.github.com/users/juniorb2ss/following{/other_user}","gists_url":"https://api.github.com/users/juniorb2ss/gists{/gist_id}","starred_url":"https://api.github.com/users/juniorb2ss/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/juniorb2ss/subscriptions","organizations_url":"https://api.github.com/users/juniorb2ss/orgs","repos_url":"https://api.github.com/users/juniorb2ss/repos","events_url":"https://api.github.com/users/juniorb2ss/events{/privacy}","received_events_url":"https://api.github.com/users/juniorb2ss/received_events","type":"User","site_admin":false},"created_at":"2018-08-17T16:17:15Z","updated_at":"2018-08-17T16:17:15Z","author_association":"NONE","body":"@hsuperman \r\n\r\nI had the same problem using the cloudfront for ssl.\r\n\r\nCanvas see the header x_forwarded_proto to estabilish ssl connection.\r\n\r\nBut, cloudfront remove this header from request, and put the header CloudFront-Forwarded-Proto\r\n\r\nI fix this problem put a nginx in front to make forward proxy with x_forwarded_proto header.\r\n\r\nCloudFront (same protocol) > nginx (with header x_forwarded_proto[https)(443 or 80) > canvas application (80)"}}
{"actor":{"display_login":"juniorb2ss"}}