https://bugs.kde.org/show_bug.cgi?id=516891
Bug ID: 516891
Summary: Network check site should use HTTP rather than HTTPS.
Classification: Websites
Product: www.kde.org
Version First unspecified
Reported In:
Platform: Other
OS: Linux
Status: REPORTED
Severity: normal
Priority: NOR
Component: general
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
Description of problem:
The network check page (https://networkcheck.kde.org) defaults to HTTPS in a
browser (tested on Firefox and Vivaldi). This prevents most captive portals
from working properly.
Steps to Reproduce:
1. On a KDE system, connect to a wifi network with a configured captive portal
(for example a bus, train or fast food restaurant).
2. A popup shows up, saying that the network needs you to log in. Clicking a
button opens the network check page in the browser.
Actual results:
The network check page tries and fails to load. The browser displays a
connection error.
Expected results:
The captive portal should intercept the connection and show the login screen
instead of the Fedora network check site.
3. Open a new tab and navigate to http://httpforever.com
4. The captive portal login screen shows up as expected.
Additional info:
>From my testing with various captive portals, the interception logic assumes a
HTTP (not HTTPS) connection. I have only encountered one captive portal that
worked with the current HTTPS implementation. In a way this is by design for
HTTPS - the captive portal is in essence performing a man in the middle attack
on your website. However, the site does not transfer any security sensitive
info (it just shows an "OK" message), so I think letting the site intercept as
designed would be preferrable.
See http://nmcheck.gnome.org/check_network_status.txt for a HTTP
implementation.
Related bug on Fedora infrastructure (but they use their own mirror of the
site):
https://bugzilla.redhat.com/show_bug.cgi?id=2443627
--
You are receiving this mail because:
You are watching all bug changes.
