search on https://www.debian.org/ sends query via unencrypted HTTP

Christian Stadelmann <[email protected]>
Newsgroups gmane.linux.debian.devel.www
Message-ID <[email protected]>
Hi

I just ran into this:
If you search something using the form on top in https://www.debian.org/
or other sites on www.debian.org the search query will be sent
unencrypted over plain HTTP. The reason is that the HTML form element
has this property:
action="http://search.debian.org/cgi-bin/omega"
This might not be what the user expects (HTTPS sites should query over
HTTPS) and may lead to warnings by the browser.

I tried using the protocol-independent version by modifying the HTML to
a protocol-independent version 
action="//search.debian.org/cgi-bin/omega"
which works fine in Firefox and WebKit and doesn't leak the query any
more.

Now I ran into a new problem: https://search.debian.org/ provides an
invalid SSL certificate (it is only valid for host names debian.org and
www.debian.org, Error code: ssl_error_bad_cert_domain).

Even if I do this it does not work since search.debian.org delivers
different sites depending on whether it is connected to by HTTP or
HTTPS: http://search.debian.org/cgi-bin/omega?DB=en&P=something delivers
a result site, https://search.debian.org/cgi-bin/omega?DB=en&P=something
delivers an error page ("Page not found").

Regards
Chris
signature.asc (application/pgp-signature, 801 B)
-----BEGIN PGP SIGNATURE-----

iQIcBAABCgAGBQJUqVvzAAoJEFlxPhHTbxwoCvQQAIZP5WaIe3THpLy203k5RjRY
kz/WO+VnIVR67WCrrKckJ82sZZXWTnc7OJsNSAWGLXew56431ELCGDGMcKwm6nw8
acR9Gf6pBdFbwWlgGxi8RuP/Qi25HbgpXw/bKSLC9ypXjWQfqMOFHKXDAV3UZe0t
b2ioj7NZ6MhawNQwIkFCZDrKYF+s1Y4SIG59e+Y0u9vZbQVWY7gvrfjzJ64x02Vh
CSF3rMcXh2ERiiLLFf73HmcL8cPdnvFaLxONlHtgiOnzyNUZ4jc+26YiYmLoU7l/
gW9HSPVCgA3McP1utZv99LtEsogTXu/ETcgeTKS2EHvQ5n1Hy9rzzeaIxu+a+V6v
GOqkEdlt1IbOgh/xELul9x2BaE4DDDuDkj3RQ99lgdhYqRUAfxOWX4sGGceacu/7
l7ULZtY1Q0tLalpnPgbWT6ld//9dZQ1NWMlOI3fuPE5P4oAUKttZeW/HPMxGmQUW
o6YKra3wdEcSpq8Q15Za6jD5fBP1bW5PmfgFs/f9oKe+W/tJozClp1Ra28vrLNFy
/pVjG9sW/qI5CdPlkyjM7q0r6utGnMbx62pebzipih3/EFB9tlTqxv3R2LaM/rJ5
FcOtaxqN+v+33GZ78oVDYdtEDT7xFpWyyp0ZJDjFTp/NoeXgeKfUZjiAHhth4Crn
RF/AHUltCuSLQUNAT9iY
=z10U
-----END PGP SIGNATURE-----
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.