New Force Links HTTPS not applied to all links

[richard7ac]

When I apply this variable and set my reverse proxy server to connect backend to the Littlelink-Custom setup the generated user pages do indeed have links that are HTTPS, however there are some pages that do not.

Certainly I found the login page and panel and some of the editing links are not honouring the Force Links option

For now I have split my proxy so all paths starting with @ get served by HTTP backend and everything else by HTTPS backend this seems to be working for now but obviously it would be good to apply the Force Link option throughout.

[JulianPrieber]

If you can list all the pages where this error occurs with screenshots of console errors, I might be able to get this working.

[richard7ac]

As mentioned above - login page and the panel and edit links. It is difficult to get the information you need as to do that I need to enable/disable HTTPS/HTTP backend to progress through between pages. Also I do not want to put up full screenshots as this would mean exposing my URL on here. Therefore I have tried to supply you what I can as below.

Below copied from Debug when viewing the login page - I replaced my domain with example.com below but all other elements are copied directly from the Chrome Inspection tool

If I disable HTTPS backend in my Proxy Server I get this on the login page

<form method="POST" action="http://example.com/login">          

By enabling HTTPS to get past the login page and then reverting to HTTP backend from my Proxy I then got these links mentioned in the page

<a href="http://example.com/studio/links/10">10</a>
<a href="http://example.com/studio/edit-link/5" class="hvr-grow mr-2"><i class="bi bi-pencil"></i> Edit</a>
<a href="http://example.com/deleteLink/5" onclick="return confirm('Are you sure you want to delete `Mastodon Social` ?')" class="float-right hvr-grow  p-1 text-danger"><i class="bi bi-trash"></i></a>
<a class="btn btn-primary" href="http://example.com/studio/add-link">Add new item</a>
<script src="http://example.com/studio/external-dependencies/jquery-1.12.4.min.js"></script>

These on the same page and are OK

<a href="https://example.com/panel/index">
<script src="https://example.com/studio/js/jquery.min.js"></script>
<script src="https://example.com/studio/js/popper.js"></script>
<script src="https://example.com/studio/js/bootstrap.min.js"></script>
<script src="https://example.com/studio/js/Sortable.min.js"></script>
<script src="https://example.com/studio/js/jquery-block-ui.js"></script>
<script src="https://example.com/studio/js/main-dashboard.js"></script>

I double checked the configuration

[JulianPrieber]

On the edit link page, I can't really do much at the moment. I'm not sure why there are popping up any issues.

The login and register pages should have been fixed with a recent update. I'm not sure why that isn't working.

[s4ke]

On our end, we bit the bullet and just use SSL to proxy to the llc container. This way the urls were generated properly.

@JulianPrieber is llc using X-Forwarded-Proto or some header to detect whether to generate https:// or http:// links?

[jbfriedrich]

I have the same problem, especially on the "Add Page Item" page I get the following errors:

add-link:223 Mixed Content: The page at 'https://test.friedrich.im/studio/add-link'
was loaded over a secure connection, but contains a form that targets an insecure
endpoint 'http://test.friedrich.im/studio/edit-link'. This endpoint should be made
available over a secure connection.

jquery.min.js:2 Mixed Content: The page at 'https://test.friedrich.im/studio/add-link'
was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint
'http://test.friedrich.im/studio/linkparamform_part/1/0'. This request has been
blocked; the content must be served over HTTPS. send @ jquery.min.js:2

add-link:1 Mixed Content: The page at 'https://test.friedrich.im/studio/add-link' was
loaded over HTTPS, but requested an insecure element
'http://test.friedrich.im/img/loading.gif'. This request was automatically upgraded to 
HTTPS, For more information see 
https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html

I enabled "Force links HTTPS" in LLC and I am using Traefik as a reverse proxy. I configured Traefik so that it would automatically convert all requests from httpto https, but it seems the aforementioned resources like the form and the JS are still using http. Here is the Traefik container config for reference:

labels:
  traefik.enable: "true"
  traefik.http.routers.landing.rule: "Host(`test.friedrich.im`)"
  traefik.http.routers.landing.tls: true
  traefik.http.routers.landing.entrypoints: websecure
  # Create the middleware to redirect traffic from HTTP to HTTPS
  traefik.http.middlewares.landing-http-to-https.redirectscheme.scheme: "https"
  traefik.http.middlewares.landing-http-to-https.redirectscheme.permanent: "true"
  # Create the middleware to add additional security headers to HTTP requests
  traefik.http.middlewares.landing-https-headers.headers.contentSecurityPolicy: "upgrade-insecure-requests"
  # Create the HTTP router that uses the middleware to redirect plaintext traffic
  traefik.http.routers.landing-http.rule: "HostRegexp(`{host:.+}`)"
  traefik.http.routers.landing-http.entrypoints: "web"
  traefik.http.routers.landing-http.middlewares: "landing-http-to-https,landing-https-headers"

[lastsamurai26]

Can you please check in your traefik dashboard which port it is using. Normally it is always forwarded to port 80 from the outside.

How did you build your Traefik.yml and Dynamic.yml?