Site(com): the HTTPS front page redirects to plain HTTP #186

New Issue

2026-11-12T11:53:26Z

rajames commented

2026-11-12 11:53:26 +00:00

Found

https://starshipos-f18.com/ answers 302 with Location: http://starshipos-f18.com/bin/view/Main/ -- HTTPS redirected down to plain HTTP. The page itself works over HTTPS (https://starshipos-f18.com/bin/view/Main/: 200, a valid certificate; Server: Apache/2.4.58 (Ubuntu)), and there is no Strict-Transport-Security header.

Seen 2026-11-12 (Captain Bob, "Emergency"): a phone on a network behind a Fortinet firewall whose web-filter licence had lapsed got "Web Page Blocked -- Web Filter Service Error: invalid license" at starshipos-f18.com/..., with the browser's "not secure" mark. The blocking is the network's, but the downgrade is ours: on plain HTTP a filter sees and rates every URL, and every visitor's session after the first redirect travels unencrypted.

Likely cause: XWiki behind Apache builds its redirect from the scheme it was proxied with (http), and Apache passes the Location through unchanged.

Done when

https://starshipos-f18.com/ redirects to an https:// URL (XWiki's xwiki.cfg: xwiki.url.protocol=https; or Apache's 443 virtual host: RequestHeader set X-Forwarded-Proto "https" and Header always edit Location ^http://starshipos-f18\.com/ https://starshipos-f18.com/)
No link or redirect on the .com leaves HTTPS (curl -sI on the pages' redirects)
Decided: an HSTS header (Strict-Transport-Security: max-age=...), so browsers never try plain HTTP
The same checked on gitea.starshipos-f18.org and the .org wiki

🤖 Filed with Claude Code -- found 2026-11-12 diagnosing the blocked page (Captain Bob: "File the issue").

### Found `https://starshipos-f18.com/` answers `302` with `Location: http://starshipos-f18.com/bin/view/Main/` -- HTTPS redirected **down to plain HTTP**. The page itself works over HTTPS (`https://starshipos-f18.com/bin/view/Main/`: 200, a valid certificate; `Server: Apache/2.4.58 (Ubuntu)`), and there is no `Strict-Transport-Security` header. Seen 2026-11-12 (Captain Bob, "Emergency"): a phone on a network behind a Fortinet firewall whose web-filter licence had lapsed got **"Web Page Blocked -- Web Filter Service Error: invalid license"** at `starshipos-f18.com/...`, with the browser's "not secure" mark. The blocking is the network's, but the downgrade is ours: on plain HTTP a filter sees and rates every URL, and every visitor's session after the first redirect travels unencrypted. Likely cause: XWiki behind Apache builds its redirect from the scheme it was proxied with (http), and Apache passes the `Location` through unchanged. ### Done when - [ ] `https://starshipos-f18.com/` redirects to an `https://` URL (XWiki's `xwiki.cfg`: `xwiki.url.protocol=https`; or Apache's 443 virtual host: `RequestHeader set X-Forwarded-Proto "https"` and `Header always edit Location ^http://starshipos-f18\.com/ https://starshipos-f18.com/`) - [ ] No link or redirect on the .com leaves HTTPS (`curl -sI` on the pages' redirects) - [ ] Decided: an HSTS header (`Strict-Transport-Security: max-age=...`), so browsers never try plain HTTP - [ ] The same checked on gitea.starshipos-f18.org and the .org wiki 🤖 Filed with [Claude Code](https://claude.com/claude-code) -- found 2026-11-12 diagnosing the blocked page (Captain Bob: "File the issue").

rajames added the

labels 2026-11-12 11:53:26 +00:00

rajames commented

2026-11-12 15:14:12 +00:00

Closed by Captain Bob's ruling, 2026-11-12: "Close the ticket and let's move on. Once I'm on a different network, I'll be okay."

The block that raised this was the network's, not the site's: a Fortinet firewall whose web-filter licence had lapsed blocks what it cannot rate. Not fixed, and still true as of closing: the HTTPS front pages of starshipos-f18.com, www.starshipos-f18.com, starshipos-f18.org and www.starshipos-f18.org redirect to plain http://, and no host sends HSTS. The fix, should it be wanted later, is in the comments above this one and in the issue: xwiki.url.protocol=https per instance; RequestHeader set X-Forwarded-Proto "https", a Location rewrite and HSTS in each 443 virtual host.

🤖 Claude Code

Closed by Captain Bob's ruling, 2026-11-12: "Close the ticket and let's move on. Once I'm on a different network, I'll be okay." The block that raised this was the network's, not the site's: a Fortinet firewall whose web-filter licence had lapsed blocks what it cannot rate. Not fixed, and still true as of closing: the HTTPS front pages of starshipos-f18.com, www.starshipos-f18.com, starshipos-f18.org and www.starshipos-f18.org redirect to plain `http://`, and no host sends HSTS. The fix, should it be wanted later, is in the comments above this one and in the issue: `xwiki.url.protocol=https` per instance; `RequestHeader set X-Forwarded-Proto "https"`, a `Location` rewrite and HSTS in each 443 virtual host. 🤖 Claude Code

rajames closed this issue

2026-11-12 15:14:17 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: rajames/LithosAnanke#186