Elvas Tower login not secure

[c44d9w]

When I try to login to Elwas Tower, Chrome prompts me that the login is not secure. On a closer look, the login form uses plain HTTP to perform the login. The credentials are included in clear text on the body.

Login forms must use HTTPS (TLS) to encript the credentials. Since I did not get the Chrome warning in the past, something must have changed at Elvas Tower.

I hope the Admin there are aware of this.

Roger

[derekmorton]

No, something has changed with chrome, its now forcing https.

Elvas tower is at the moment http only.

[c44d9w]

I don't think it is Chrome. I tried Firefox, and it also gives me a security warning. Looking at the developer tools, Firefox makes the POST request as plain HTTP.

POST http://www.elvastower.com/forums/index.php?app=core&module=global&section=login&do=process
​

[c44d9w]

Inspecting the login button, the form always uses http, even if the GET used https.


image.png

[derekmorton]

Elvas tower has not changed for a long time.
Your changes are with chrome, other forums are full of it.

[eric]

Correct -- this is an issue with Chrome and possibly other browsers now no longer playing nice with mixed HTTP and HTTP content.

In Chrome, all you need to do is open up Settings --> Privacy and Security, and disable "Always use secure connections"

capture_400741.jpg

The default when you enter a URL will be HTTPS, but with that setting disabled, you can enter http:// for sites that aren't using HTTPS.

[rt35ge]

Was this change for Chrome within the last 10 days? Chrome went all twilight zone on me around a week ago...... I was required to verify all my logins on the websites I use. On some, Norton goes all crazy saying all sorts of Trojans are trying to get in. Switch to Firefox or Edge and I don't get that crap.

[eric]

Seems that Chrome issues have been popping up particularly around logins over the last 2-3 weeks primarily at sites which use a mix of http and https...

I've only heard of one person here, and they were able to resolve their issue by logging out and back in again.

Not sure if it's in response to something else, or proactive.

[TrainSimJack]

Inspecting the login button, the form always uses http, even if the GET used https.


image.png

C44d9w,
Can you hit Control-F5 on your browser to force a cache refresh and see if the problem goes away?

[c44d9w]

Can you hit Control-F5 on your browser to force a cache refresh and see if the problem goes away?

Thanks, TrainSimJack. That worked. I actually cleared all my site data and the cache. Then the form got submitted securely with HTTPS, no complaint from Chrome. No need to change browser config.

[UPATSFTrainz2004]

I tried many times but i can't