SSL and Kraken API

[dedihost]

In first - sorry for my english (is not good), i am from Bulgaria.

I've use your kraken version of api to get latest streams. After some days i get ssl for my site and i have only 2 bugs to clear the ssl.
Links for images in cdn started with http: protocol and ssl sertificate for my site and my browser has marked this links as mixed content.
I want to clear this.

Your videos is OK (its started with https), but images not.

Here is example:
Streams its shows like https://api.twitch.tv/kraken/channels/mpkbk/stream_key
But pictures like: http://static-cdn.jtvnw.net/jtv_user_pictures/imaqtpie-channel_header_image-3291f90258607a33-640x125.png
i test with https and its work.

Yep, static cdn have https (Ssl protocol) and maybe the right way is to change this:

Please, fix this. Its important for everybody with ssl sites. I dont want to use replace functions in javascript (its complicated and messy)

[kokarn]

You can actually just change from http to https and then it works :)

On Fri Dec 26 2014 at 10:49:34 PM dedihost notifications@github.com wrote:

In first - sorry for my english (is not good), i am from Bulgaria.

I've use your kraken version of api to get latest streams. After some days
i get ssl for my site and i have only 2 bugs to clear the ssl.
Links for images in cdn started with http: protocol and ssl sertificate
for my site and my browser has marked this links as mixed content.
I want to clear this.

Your videos is OK (its started with https), but images not.

Here is example:
Streams its shows like
https://api.twitch.tv/kraken/channels/mpkbk/stream_key
But pictures like:
http://static-cdn.jtvnw.net/jtv_user_pictures/imaqtpie-channel_header_image-3291f90258607a33-640x125.png
i test with https and its work.

Yep, static cdn have https (Ssl protocol) and maybe the right way is to
change this:

Please, fix this. Its important for everybody with ssl sites. I dont want
to use replace functions in javascript (its complicated and messy)

—
Reply to this email directly or view it on GitHub
#300.

[t-richards]

You can actually just change from http to https and then it works :)

This is an unacceptable solution, and it ignores this bit entirely:

I dont want to use replace functions in javascript (its complicated and messy)

When I query an API over HTTPS, I also expect the response URLs to match the HTTPS protocol. For example, https://api.twitch.tv/kraken/users/test_user1 spits out the following response:

{
    "display_name": "Test_user1",
    "_id": 22747064,
    "name": "test_user1",
    "type": "user",
    "bio": null,
    "created_at": "2011-06-02T20:04:03Z",
    "updated_at": "2015-04-04T20:19:13Z",
    "logo": "http://static-cdn.jtvnw.net/jtv_user_pictures/test_user1-profile_image-ac0a2f0d39dda770-300x300.jpeg",
    "_links": {"self": "https://api.twitch.tv/kraken/users/test_user1"}
}

While it is true that the logo URL is valid when rewritten as HTTPS, I would rather not manually rewrite the URL.

Furthermore, when using the embedded flash player, even when loading directly over HTTPS (https://www-cdn.jtvnw.net/swflibs/TwitchPlayer.swf), there a large number of requests made by the player itself that go to http:// resources. These requests throw mixed content warnings, and can be identified by the X-Requested-With: ShockwaveFlash/... header.

I implore you, please think about the pretty green lock icons! 😄

Edit: Derp, this issue is a duplicate of #237.