Fix disappearing newsletter subscription form under https

[cbeams]

• see if we should use spring-ws or marketo's jar API
• get credentials (username, secret key, SOAP endpoint)
• get specific SOAP args for spring.io when creating a lead (lead source, munchkin ids...)
• integrate HTML+CSS for newsletter form and remove iframe code
• create a SOAP client
• create a REST endpoint

---

• @jacksoncvm to respond to Fix disappearing newsletter subscription form under https #117 (comment)
• @bclozel to update the issue with new TODO items (marketo's API)

Our current HSTS configuration forces https everywhere on the site, resulting in internal users copying and pasting https urls instead of http. This is problematic because there are https-related bugs in a couple areas on the site, and external users shouldn't be exposed to these.

[cbeams]

On Dec 17, 2013, at 11:50 PM, @phumphrey wrote:

ping on this. Where is this fitting in current priority stack?

It remains in the backlog without any particular priority. Is this continuing to come up as a problem for you as described above? Perhaps @rwinch would be interested in putting together a pull request. Rob?

[cbeams]

On Dec 20, 2013, at 8:26 PM, @phumphrey wrote:

I ask because I know that I have been copy and pasting https:// URls everywhere in my promo materials, considering sending a mail to dev list, devrel, everyone to ask that they make sure to use http:// form of the URL when linking to things -- that wasy the subscribe button isn't broken.

[cbeams]

Roger that, @phumphrey. Hopefully @rwinch can weigh in here, though it might understandably be post-holidays.

[rwinch]

HSTS specification does not allow you to configure based upon the URL only by domain. So we would need to create a unique domain for the admin users to be using and ensure we are using that domain anytime users were administering the application. For example, we might create a URL like secure.spring.io that we could then force users to HTTPS.

[gregturn]

Sounds a bit complex to manage two domains. Imagine possible places where we have relative links going between admin and non admin. Is this what we really want?

Also smells like an update to spring security docs is in order to raise awareness of this in case devs are trying to do similar things on their own site.

Sent from my iPhone

On Jan 2, 2014, at 8:32 AM, Rob Winch notifications@github.com wrote:

HSTS specification does not allow you to configure based upon the URL only by domain. So we would need to create a unique domain for the admin users to be using and ensure we are using that domain anytime users were administering the application. For example, we might create a URL like secure.spring.io that we could then force users to HTTPS.

—
Reply to this email directly or view it on GitHub.

[cbeams]

Thanks @gregturn, agreed re: complexity, etc. @rwinch and I just chatted via voice and landed on this as a plan:

• leave the current HSTS settings in place—which actually do not send the Strict-Transport-Security: header unless and until the user requests something under /admin. This means that if a user clicks a link like https://spring.io/blog/xyz, they are not locked into HSTS. i.e. they can strip the https: back to http: and still view the content that way.
• Fix the real underlying problem, which is that the newsletter subscription form is being brought in via an iframe that disappears under https (for as yet not fully understood reasons). What we ideally want to do sign folks up for the newsletter from our own domain, and ditch the iframe approach altogether. @jacksoncvm looked into this previously, and it looked like we were pretty stuck with slurping in this content from the gopivotal site, I believe due to Marketo-related restrictions. Chloe, we had this conversation under an email thread with the subject line "Marketo URL for posting email subscriptions?". Could you look back into this issue, talk with Christina D. again, perhaps, and see what we can do? It would think must be possible—some way—to manage Marketo newsletter subscriptions from multiple domains...? It seems we really need to dig into this and actually solve it.

[jacksoncvm]

For now, we could put the 'Subscribe to our Newsletter' text inside the iframe so at least it doesn't look broken.

The Pivotal Network team has started using the Marketo API. I'm assuming we could do the same. I'll ask them if they have any tips.

[jacksoncvm]

Just heard back. They said they'd send their code over later this week. Meanwhile, I can work on the iframe change (to include the 'subscribe' text in the frame).