4

I know that HTTPS isn't officially supported, but it works well enough for me on StackExchange most of the time.

Recently something changed with chat so that I can't login to it with the HTTPS Everywhere plugin (in Firefox) enabled.

My use case:

  • I'm on Pro Webmasters (using HTTPS)
  • From the "StackExchange" menu I select "chat" to get to the Pro Webmasters chat rooms
  • I go to chat (also on HTTPS), but it is a list of chat rooms that are not specific to the webmaster site. I also notice that I'm not logged in.
  • I click the "login" link and I get get the message Please log in to any StackExchange site first, or log in via StackExchange.com.
  • Firefox pops up the security warning: Although this page is encrypted, the information you have entered is to be sent over an unencrypted connection and could easily be read by a third party. Are you sure you want to continue sending this information? (I hit "Continue")
  • The chat server gives me the error No referer was present - this may be due to a browser setting

Up until a week or two ago I was able to access chat even when using the HTTPS Everywhere plugin. Something changed recently.

1

Looks like this is a side-effect of the fact that the chat link is not protocol-relative, causing Firefox not to send a Referer (sic) header when it's clicked, even though HTTPS Everywhere actually rewrites the request to use HTTPS.

As a work-around, consider installing Greasemonkey and the Stack Overflow Unofficial Patch (SOUP) user script, which rewrites such links to use HTTPS before you click them, allowing the correct Referer header to be sent.

BTW, you might also consider reporting this as a bug in HTTPS Everywhere. Even if it's not possible for the extension to pass the Referer header along, it might be possible to rewrite the chat links to contain this information in the URL itself using the following syntax:

However, this would presumably require some way for the HTTPS Everywhere ruleset to embed parts of the referring page's URL into the rewritten URL; I don't know if such a feature exists yet, or how difficult it would be to develop.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .