Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Still HTTPS issue #11478

Closed
MESWEB opened this issue Mar 12, 2017 · 10 comments
Closed

Still HTTPS issue #11478

MESWEB opened this issue Mar 12, 2017 · 10 comments
Labels
answered For when a question was asked and we referred to forum or answered it.

Comments

@MESWEB
Copy link

MESWEB commented Mar 12, 2017

PIWIK messing security of the website
zrzut ekranu 2017-03-12 13 08 33

@Findus23
Copy link
Member

@MESWEB
There is something wrong with your webserver configuration:

The tracking request https://piwik.auctio.uk/piwik.php?action_name=auctio.uk&idsite=1&rec=1&r=695582&h=14&m=15&s=20&url=https%3A%2F%2Fauctio.uk%2F&_id=ca718d81d71254bf&_idts=1489324450&_idvc=1&_idn=0&_refts=0&_viewts=1489324450&send_image=1&pdf=1&qt=0&realp=0&wma=0&dir=0&fla=0&java=0&gears=0&ag=0&cookie=1&res=1920x1080&gt_ms=197&pv_id=fxXl6Q
gets redirected to http://piwik.auctio.uk/
which redirects to https://piwik.auctio.uk/

@MESWEB
Copy link
Author

MESWEB commented Mar 12, 2017

So what I should to ask my hosting support?

@Findus23
Copy link
Member

Findus23 commented Mar 12, 2017

I can't test anymore as http://auctio.uk/ doesn't load anymore. (seems like my IP got blocked), but there seems to be a wrong redirect (maybe in a .htaccess-file?)

UPDATE: my VPS is now also blocked, seems like your hoster doesn't like curl.

BTW: refs #11477

@Findus23
Copy link
Member

Now all my IPs are blocked but it seems like the tracking code is correct. Is it possible that there is some regex that matches some text in the GET parameters? (maybe action_name=auctio.uk)

But it still doesn't make sense that it redirects to the http site.

@MESWEB
Copy link
Author

MESWEB commented Mar 12, 2017

No. I was contact with host support and we found issue with PIWIK script. Piwik sending request by http: like display images in dashboard with http://

@Findus23
Copy link
Member

Could you be more specific what exactly the http request is?

I am still blocked, but I have tested it via my phone and this are the requests:
screenshot_20170312_214108
At first the piwik js-file is loaded (via https): https://piwik.auctio.uk/piwik.js.
Then a visit is tracked via the tracking-pixel https://piwik.auctio.uk/piwik.php?idsite=1&rec=1
I guess you'll want to remove the <img> or wrap it with a <noscript> as it is only needed when javascript is disabled.

<!-- End Piwik Code --><!-- Piwik Image Tracker-->
<img src="//piwik.auctio.uk/piwik.php?idsite=1&rec=1" style="border:0" alt="" />
<!-- End Piwik --><!-- jQuery (necessary for Bootstrap's JavaScript plugins) -->

Next the piwik tracking script sends the data back (via HTTPS)
https://piwik.auctio.uk/piwik.php?action_name=auctio.uk&idsite=1&rec=1&r=354129&h=21&m=38&s=15&url=https%3A%2F%2Fauctio.uk%2F&_id=e3374b7377e825bf&_idts=1489351095&_idvc=1&_idn=0&_refts=0&_viewts=1489351095&send_image=1&pdf=1&qt=0&realp=0&wma=0&dir=0&fla=0&java=0&gears=0&ag=0&cookie=1&res=1920x1080&gt_ms=234&pv_id=KiV8jM

But instead of saving the data, the server response with a 302-redirect to http://piwik.auctio.uk/. (Because of that I assume the visit won't show up in Piwik (or just because of the image tracker))

HTTP/1.1 302 Found
Date: Sun, 12 Mar 2017 20:38:13 GMT
Server: Apache
Location: http://piwik.auctio.uk/
Content-Length: 207
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

The browser follows the redirect to http://piwik.auctio.uk/ but again gets another (this time permanent redirect to https://auctio.uk/:

HTTP/1.1 301 Moved Permanently
Date: Sun, 12 Mar 2017 20:38:13 GMT
Server: Apache
Location: https://auctio.uk/
Content-Length: 226
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

To sum up: The piwik tracking tries to send the data via https, but gets redirected to the homepage via http which causes chrome to complain.

@MESWEB
Copy link
Author

MESWEB commented Mar 12, 2017

Yes but I have problem with images on dashboard
zrzut ekranu 2017-03-12 22 09 01
So I think piwik.js have bug with https.

@slawa-dev
Copy link

@MESWEB I use piwik with https and have no issues. It is definitely your setup that does wrong redirects which break piwik.

check your url rewrite rules , etc.

When I open http://auctio.uk I get redirected to https://https//auctio.uk//

@MESWEB
Copy link
Author

MESWEB commented Mar 13, 2017

@S1awa Ok. Sorry for that. Now is working I was change .htaccess.

@MESWEB
Copy link
Author

MESWEB commented Mar 14, 2017

Problem fixed by:
disabled mod_security

@mattab mattab closed this as completed Mar 21, 2017
@mattab mattab added the answered For when a question was asked and we referred to forum or answered it. label Mar 21, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
answered For when a question was asked and we referred to forum or answered it.
Projects
None yet
Development

No branches or pull requests

4 participants