Loaded over HTTPS, but requested an insecure XMLHttpRequest

[DaleMcGrew]

Hi @josephevans and @nf071590 , I am noticing errors in the console log that seem related to load balancing and a timeout:

1. Go to https://wevote.me
2. Enter "Charlotte, NC 28205" as your address.
3. Go to your ballot. (You should see many presidential candidates.)
4. Click on "More Opinions" icon in top right.
5. "Follow" 4 or 5 orgs.
6. Wait 5-10 minutes.
7. Go to "Opinions I'm Following" in the More menu, and you should see this error in the console log:
   Mixed Content: The page at 'https://wevote.me/more/opinions/followed' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://wevote.me:3000/browser-sync/socket.io/?EIO=3&transport=polling&t=1457980019076-35'. This request has been blocked; the content must be served over HTTPS.

[josephevans]

Does the React/Flux stuff support using headers for determining it's self URL (like we did with the Django side?)

The page itself is generating the links on where to go, so we either need to change them there or have the application support looking for and using headers inserted by the proxy.

[DaleMcGrew]

@nf071590 what do you think?

[DaleMcGrew]

Hi @josephevans, can you look into configuring the React side to solve this problem?
I was looking through the nginx logs and wish I understood better how the routing works. (the following is from /var/log/nginx/access.log)
172.31.9.218 - - [16/Mar/2016:17:18:54 +0000] "GET /apis/v1/voterGuidesToFollowRetrieve/?voter_device_id=q8NneOJbEWS5EY7l6pQyEcPI2gXhVo7LaikAkpjl8OUoB9X5rkkHVKMBhaYfwg1b3YdbQzsvuBFUfE62AC7CcgXp&google_civic_election_id=2000 HTTP/1.1" 200 17567 "http://localhost:3000/opinions" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.109 Safari/537.36"
172.31.9.218 - - [16/Mar/2016:17:18:59 +0000] "GET /apis/v1/voterAddressSave/?voter_device_id=9lXfDJuEb9hXrnrb6F3osm1Km7SQjnLFrPAUbGeYrW0Pvv5fcbKsjD0tN0BLyuwJLO7b3sFH3YIKeuAB2JFpBxpJ&text_for_map_search=Charlotte%2C+NC+28205 HTTP/1.1" 500 73390 "https://wevote.me/settings/location" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
172.31.9.218 - - [16/Mar/2016:17:18:59 +0000] "GET /apis/v1/voterBallotItemsRetrieve/?voter_device_id=9lXfDJuEb9hXrnrb6F3osm1Km7SQjnLFrPAUbGeYrW0Pvv5fcbKsjD0tN0BLyuwJLO7b3sFH3YIKeuAB2JFpBxpJ&use_test_election=true HTTP/1.1" 200 393 "https://wevote.me/ballot" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
cc: @nf071590

[josephevans]

Hi Dale,

The part you highlighted in bold (http://localhost:3000/opinions) is the HTTP referrer -- which means someone is running the ReactFlux server on their local machine, which references the api.wevoteusa.org URL. This should be normal.

I will see what config options I can make to have node.js generate the correct URLs.

[FeeYo7]

Browser sync is running because we never made a build system for
production. I think if you go to we.vote:3003 (or 3001) you could see all
the browsers connected to the server lol.
On Mar 14, 2016 2:33 PM, "Dale John McGrew" notifications@github.com
wrote:

Hi @josephevans https://github.com/josephevans and @nf071590
https://github.com/nf071590 , I am noticing errors in the console log
that seem related to load balancing and a timeout:

1. Go to https://wevote.me
2. Enter "Charlotte, NC 28205" as your address.
3. Go to your ballot. (You should see many presidential candidates.)
4. Click on "More Opinions" icon in top right.
5. "Follow" 4 or 5 orgs.
6. Wait 5-10 minutes.
7. Go to "Opinions I'm Following" in the More menu, and you should see
   this error in the console log:
   Mixed Content: The page at 'https://wevote.me/more/opinions/followed' was
   loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint '
   http://wevote.me:3000/browser-sync/socket.io/?EIO=3&transport=polling&t=1457980019076-35'.
   This request has been blocked; the content must be served over HTTPS.

—
Reply to this email directly or view it on GitHub
#137.

[DaleMcGrew]

Thank you @nf071590, I will create an issue for "Create Build System for WeVote.me". Do you have any suggestions for how Joe can solve these errors prior to creating the build system?

[FeeYo7]

Remove browsersync task from the gulp file.
On Mar 16, 2016 2:49 PM, "Dale John McGrew" notifications@github.com
wrote:

Thank you @nf071590 https://github.com/nf071590, I will create an issue
for "Create Build System for WeVote.me". Do you have any suggestions for
how Joe can solve these error prior to creating the build system?

—
You are receiving this because you were mentioned.
Reply to this email directly or view it on GitHub
#137 (comment)

[josephevans]

@nf071590 We should remove browsersync from the production git repo?

[DaleMcGrew]

Fixed!

[DaleMcGrew]

@josephevans I spoke too soon. When I did an update to https://wevote.me the problem returned. I left your changes in /home/wevote/WebApp/Gulpfile.js, but for some reason the problem has come back.