Upload form to Aggregate should support HTTP about build HOT 6 CLOSED

They are visible from the Internet.

from build.

The JavaRosa documentation has a lot to say about not allowing http: https://bitbucket.org/javarosa/javarosa/wiki/AuthenticationAPI

I find it vanishingly unlikely that somebody will have a local server that is accessible from the Internet at large anyway?

from build.

My reading of the spec is that you should use HTTPS, but it isn't required.

The vast majority of local Aggregate servers (and there are a fair bit of those) I come across do not have HTTPS enabled. This is mostly because installing a SSL cert on Tomcat is a miserable task.

from build.

Question stands: are those servers visible from the internet, though, or are they likely to be behind a NAT?

from build.

PR #101 started on this ticket, but it still needs more work:

The request here is to allow both http and https server addresses, so there are quite a few spots that need adjustment:

• The UI should neither assume http nor https, and allow either option, either via a <select> tag or via format validation with meaningful error text to the user.
• The server currently assumes https.
• I'd personally appreciate it if there were a security notice at the bottom (if you go with a <select>, ideally only show it if http is chosen) noting that the user's authentication credentials will be sent insecurely. Sample wording: "Warning: sending data to a non-HTTPS Aggregate server will mean your credentials and data are sent over the web insecurely."

I like that #101 left one example https and changed one to http.

from build.

Hi,
Sorry for the thread necromancy, but the unsecured HTTP is still not supported correctly enough. Currently, there is this in the code: https://github.com/opendatakit/build/blob/283da5840c7f83adf8228c558311266723b83fc1/server/odkbuild_server.rb#L252-L255
which forces http.use_ssl = true every time, resulting in OpenSSL handshake error on plain HTTP. It seems like an easy fix, but I have absolutely zero knowledge of ruby, so I don't dare to make one.

from build.