[jira] [Comment Edited] (OFBIZ-9206) Login and logout process in demos shows a certificate issue

[Nicolas Malin (Jira)]

    [ https://issues.apache.org/jira/browse/OFBIZ-9206?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15884160#comment-15884160 ]

Jacques Le Roux edited comment on OFBIZ-9206 at 2/25/17 9:41 AM:
-----------------------------------------------------------------

Hi [~jacques.le.roux] , thanks for working on this.

I applied your patch.
added the "    <SystemProperty systemPropertyId="port.https" systemResourceId="url" systemPropertyValue=""/>"
into the table.

Login mask now still shows the hostname:port in the urls.

I'm not quiet sure if I follow the discussion above.
What's the intended behaviour?
In which cases should it show the full hostname+port and in which cases it should not?

Based on looking at it, for me it would make sense that it should never generate the full hostname:port url, unless it's explicitly set in the url.properties / SystemProperty table.
But I'm not sure if I understand all the cases/scenarious

Best
Leo

{code}
<div class="screenlet-body">
      <form method="post" action="https://localhost:8443/catalog/control/login" name="loginform">
        <table class="basic-table" cellspacing="0">
          <tr>
            <td class="label">User Name</td>
            <td><input type="text" name="USERNAME" value="" size="20"/></td>
          </tr>
          <tr>
            <td class="label">Password</td>
            <td><input type="password" name="PASSWORD" value="" size="20"/></td>
          </tr>
          <tr>
            <td colspan="2" align="center">
              <input type="submit" value="Login"/>
            </td>
          </tr>
        </table>
        <input type="hidden" name="JavaScriptEnabled" value="N"/>
        <br />
        <a href="https://localhost:8443/catalog/control/forgotPassword_step1">Forgot Your Password?</a>
      </form>
    </div>
    {code}


was (Author: leonardlin):
Hi [~jacques.le.roux] , thanks for working on this.

I applied your patch.
added the "    <SystemProperty systemPropertyId="port.https" systemResourceId="url" systemPropertyValue=""/>"
into the table.

Login mask now still shows the hostname:port in the urls.

I'm not quiet sure if I follow the discussion above.
What's the intended behaviour?
In which cases should it show the full hostname+port and in which cases it should not?

Based on looking at it, for me it would make sense that it should never generate the full hostname:port url, unless it's explicitly set in the url.properties / SystemProperty table.
But I'm not sure if I understand all the cases/scenarious

Best
Leo

------copy-paste---------
<div class="screenlet-body">
      <form method="post" action="https://localhost:8443/catalog/control/login" name="loginform">
        <table class="basic-table" cellspacing="0">
          <tr>
            <td class="label">User Name</td>
            <td><input type="text" name="USERNAME" value="" size="20"/></td>
          </tr>
          <tr>
            <td class="label">Password</td>
            <td><input type="password" name="PASSWORD" value="" size="20"/></td>
          </tr>
          <tr>
            <td colspan="2" align="center">
              <input type="submit" value="Login"/>
            </td>
          </tr>
        </table>
        <input type="hidden" name="JavaScriptEnabled" value="N"/>
        <br />
        <a href="https://localhost:8443/catalog/control/forgotPassword_step1">Forgot Your Password?</a>
      </form>
    </div>

> Login and logout process in demos shows a certificate issue
> -----------------------------------------------------------
>
>                 Key: OFBIZ-9206
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-9206
>             Project: OFBiz
>          Issue Type: Bug
>          Components: Demo
>            Reporter: Jacques Le Roux
>            Assignee: Jacques Le Roux
>            Priority: Minor
>         Attachments: OFBIZ-9206.patch
>
>
> When, from the site main page http://ofbiz.apache.org/, you get to the demos depending on browser (tested on Windows 7) you get some issues:
> * FF
> ** Management Apps: OK
> ** Ecommerce: OK
> * Chrome (Management Apps or Ecommerce)
> ** stable: OK
> ** old: KO - If you copy the URL by hand it works, and after even from the main page it works.
> ** trunk: OK
> * IE, same than Chrome
> If, from any browser, you logout from Management Apps you get a certificate issue. Actually as we use HSTS the browsers protect us from any 3rd party intrusions... Same issue when login in.
> So it seems we have a certificate issue after OFBIZ-7928 and INFRA-11960. Maybe it's due to how OFBiz redirects when login in or login out because, so far, only the login page is concerned...

--
This message was sent by Atlassian JIRA
(v6.3.15#6346)