@puiterwijk If you could take a look at this and review it, that would be useful.

From the stand up today:

[14:02:58] <nirik> I think this is intended/fine, but I'd prefer our security officer check it.

<nirik> I think this is intended/fine

This is definitely not fine. Insecure HTTP redirects can be used for MITM attacks and credentials hijacking.

Also it doesn't work with Firefox's HTTPS only mode:

Clean all cookies, login with Kerberos, then press Login button on any Fedora SSO compatible website

Could you tell us which website you are seeing this with?
curl https://pagure.io/login seems to redirect to https, so I think it's not any
website

Could you tell us which website you are seeing this with?

1. Enable HTTPS only mode in Firefox's settings.
2. Open https://pagure.io/login.

So, the reason I said this was expected is because our openid identities have always been http://username.id.fedoraproject.org. Your first guess will be that this is insecure, but it's not due to the way openid works. See: https://meetbot.fedoraproject.org/fedora-classroom/2013-02-22/fas-openid-class.2013-02-22-18.00.log.html
basically it sends you that http:// redirect, but it also connects to id.fedoraproject.org and they exchange info, so if someone MITM's the http connection, the reply there will fail to match what the sites have negotiated and be rejected. At least this is my recollection of how it works.

In any case we can't change them now I don't think or everyone will have new identities. Also, we don't want to keep using openid anymore if we can possibly avoid it.

So, perhaps this is more fuel to move pagure over to oidc?

Perhaps @puiterwijk could chime in here and correct me...

basically it sends you that http:// redirect, but it also connects to id.fedoraproject.org and they exchange info, so if someone MITM's the http connection, the reply there will fail to match what the sites have negotiated and be rejected. At least this is my recollection of how it works.

But a few weeks ago it worked fine in Firefox with HTTPS only feature enabled.

This is definitely not intended, and have indeed been able to reproduce it.
I am now looking at this.

Many thanks @puiterwijk

Commit 31a3e49c relates to this ticket

@xvitaly Thank you very much for your report. Could you please try to log in again?

@xvitaly Thank you very much for your report. Could you please try to log in again?

Fixed. Thanks.

Thanks! Sorry if I sidetracked things... :(