23 April 2010, 6:07

Hi All,

I was wondering if anyone had found a workaround for delivering a secure Mahara login page (SSL) without triggering security warnings in Internet Explorer 7 & 8 relating to mixed secure and unsecure content?

I realise I could secure the whole site but then I get the same warnings whenever external content (such as YouTube videos) is referenced within Mahara.

Any advice, pointers, thoughts would be most welcome.

Many thanks,

Ben

31 August 2011, 19:25

A bump for this topic.

What is the current recommended method for providing secure logins? Does the whole site have to be served https...in which case the IE security warnings appear?

31 August 2011, 20:50

As of 1.4, the only way to have secure logins is to serve the whole site over HTTPS. While the old way of using https for logins would avoid sending passwords in plain text, it was still possible (and easy) to steal sessions and masquerade as another user. Therefore we have chosen to remove this code.

If you find any places in Mahara that don't use the right protocol when embedding external content, please file a bug and we'll get it fixed. We have fixed a few recently.

Cheers,

Francois