Re-submit causes do_the_halfnarp to fail

[zecke]

1. Go to https://halfnarp.events.ccc.de and submit your selection
2. 33C3-halfnarp-api http://halfnarp.events.ccc.de/-/talkpreferences/... will be saved to local storage
3. Re-submit (in Safari and most likely others too) will fail with something like

[blocked] The page at https://halfnarp.events.ccc.de/#.... was not allowed to display insecure content from http://halfnarp.events.ccc.de/-/talkpreferences/....

I don't know pyramid at all but self.request.route_url in the view is most likely returning the http:// url? Is X-Forwarded-Proto or something like that not set?

[erdgeist]

the halfnarp API is set by your browser, maybe you've been visiting the halfnarp via http before?

[erdgeist]

Ahh, now I see what you mean. Will look into how to fix it client side, if it was stored with a http scheme in localStorage.

[zecke]

Great, and I just finished getting a simple reproducer out of chrome. Request made through https and "public_url/update_url" returns a http:// url. Thanks for fixing it.

curl 'https://halfnarp.events.ccc.de/-/talkpreferences' -H 'Origin: https://halfnarp.events.ccc.de' -H 'Accept-Encoding: gzip, deflate, br' -H 'Accept-Language: en-US,en;q=0.8,de;q=0.6' -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.98 Safari/537.36' -H 'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H 'Accept: application/json, text/javascript, */*; q=0.01' -H 'Referer: https://halfnarp.events.ccc.de/' -H 'X-Requested-With: XMLHttpRequest' -H 'Connection: keep-alive' -H 'DNT: 1' --data '{"talk_ids":[]}' --compressed
{"public_url": "http://halfnarp.events.ccc.de/-/talkpreferences/public/41c1c8f1a1369808a0385584e484f53ad7749194d975411721409ee40ffa24de", "update_url": "http://halfnarp.events.ccc.de/-/talkpreferences/887bd66d610b48cbacc348724fb21928", "hashed_uid": "41c1c8f1a1369808a0385584e484f53ad7749194d975411721409ee40ffa24de", "uid": "887bd66d610b48cbacc348724fb21928"}