Tickets :: [#405] IE use_ssl=3 issue

Summary	IE use_ssl=3 issue
Queue	Horde Base
Queue Version	HEAD
Type	Bug
State	Resolved
Priority	1. Low
Owners
Requester	aj (at) mindcrash (dot) com
Created	07/21/2004 (1547 days ago)
Due
Updated	07/22/2004 (1546 days ago)
Assigned	07/22/2004 (1546 days ago)
Resolved	07/22/2004 (1546 days ago)
Attachments
Milestone
Patch	No

07/22/2004	aj (at) mindcrash (dot) com	Comment #9	Reply to this comment
Fixed for me.. Thanks Chuck.

07/22/2004	Chuck Hagenbuch	Comment #8 State ⇒ Resolved	Reply to this comment
Should be fixed in CVS now.

07/22/2004	aj (at) mindcrash (dot) com	Comment #7	Reply to this comment
I just tried a basic META REFRESH from an https url to an http url and I did not get the warning. I don't know if something like that is possible or maybe some javascript redirect code?

07/22/2004	Jan Schneider	Comment #6	Reply to this comment
No, this is something different. They are talking about POST redirects, but we only do a GET redirect. The problem is that we redirect from an https address to an http address.

07/22/2004	aj (at) mindcrash (dot) com	Comment #5	Reply to this comment
Jan, I have read a few people have gotten around this by using a javascript redirect of some kind, which is I think what hotmail uses, not sure though. Here is something I found, not sure if it will help: http://ppewww.ph.gla.ac.uk/~flavell/www/post-redirect.html What are your thoughts?

07/22/2004	Jan Schneider	Comment #4	Reply to this comment
Exactly. Did you find out if other redirects (with different response numbers perhaps) don't trigger this warning?

07/22/2004	aj (at) mindcrash (dot) com	Comment #3	Reply to this comment
I've looked at hotmail and gmail and they both seem to just encrypt the login session, while everything else is plain http. In digging for some answers, I came up with the fact that IE will issue this warning when a "page moved" request is made from ssl to non-ssl. Is this how redirect in imp works?

07/22/2004	Jan Schneider	Comment #2 State ⇒ Feedback	Reply to this comment
AFAIK, this is something that only can be turned off in IE. I suppose other sites simply stay in HTTPS mode after login.

07/21/2004	aj (at) mindcrash (dot) com	Comment #1 State ⇒ Unconfirmed Priority ⇒ 1. Low Type ⇒ Bug Queue ⇒ Horde Base	Reply to this comment
When using use_ssl=3 and IE, the user gets a dialog box that warns the user that they are being redirected to an insecure page. This occurs when using IMP for authentication. This does not happen on firefox. Other webmail sites hotmail, gmail, etc... seem to implement this w/o this warning box. Not sure if this would be considered a bug or enhancement. Is there any way to get rid of this while using IE?