Upload form to Aggregate should support HTTP

[yanokwa]

Currently, the Upload Form to Aggregate Instance URI starts with https. Local servers of ODK Aggregate are often http so we should support it.

And if we do, the second example in the dialog box should be http.

[issa-tseng]

The JavaRosa documentation has a lot to say about not allowing http: https://bitbucket.org/javarosa/javarosa/wiki/AuthenticationAPI

I find it vanishingly unlikely that somebody will have a local server that is accessible from the Internet at large anyway?

[yanokwa]

My reading of the spec is that you should use HTTPS, but it isn't required.

The vast majority of local Aggregate servers (and there are a fair bit of those) I come across do not have HTTPS enabled. This is mostly because installing a SSL cert on Tomcat is a miserable task.

[issa-tseng]

Question stands: are those servers visible from the internet, though, or are they likely to be behind a NAT?

[yanokwa]

They are visible from the Internet.

[issa-tseng]

PR #101 started on this ticket, but it still needs more work:

The request here is to allow both http and https server addresses, so there are quite a few spots that need adjustment:

• The UI should neither assume http nor https, and allow either option, either via a <select> tag or via format validation with meaningful error text to the user.
• The server currently assumes https.
• I'd personally appreciate it if there were a security notice at the bottom (if you go with a <select>, ideally only show it if http is chosen) noting that the user's authentication credentials will be sent insecurely. Sample wording: "Warning: sending data to a non-HTTPS Aggregate server will mean your credentials and data are sent over the web insecurely."

I like that #101 left one example https and changed one to http.

[trendspotter]

Hi,
Sorry for the thread necromancy, but the unsecured HTTP is still not supported correctly enough. Currently, there is this in the code: https://github.com/opendatakit/build/blob/283da5840c7f83adf8228c558311266723b83fc1/server/odkbuild_server.rb#L252-L255
which forces http.use_ssl = true every time, resulting in OpenSSL handshake error on plain HTTP. It seems like an easy fix, but I have absolutely zero knowledge of ruby, so I don't dare to make one.