Thought I’d come back and give the final answer. Thank you to everyone that suggested “Do not save encrypted pages to disk”. I followed EricLaw’s advice and set: Cache-Control: private I also found that I had Pragma: no-cache, which I removed. Works like a charm now 🙂
TL;DR set FB._https to true before calling FB.init. Like so: FB._https = true; FB.init({ /* your app id and stuff */ }); Explanation If you unminify the Facebook JavaScript SDK, you’ll see that its basically an object literal with a bunch of properties. One of these properties is _https, which is a boolean. This property … Read more
As you did saw yourself in GitHub support, Scott Schacon himself suggested: So I guess your .netrc is incorrect or something? Try removing the info from your .netrc and cloning first (since it’s a public repo). If it isn’t a GitHub server issue, it could be your firewall. And/or your proxy (git config –global http.proxy … Read more
It’s not a problem with Apache, but with the fact that Rails sends an HSTS header. In Chrome, you can clear the HSTS state by going into about:net-internals, as described in ImperialViolet: HSTS UI in Chrome. You may also have to clear the cache, since config.force_ssl = true also uses a 301 (permanent) redirection. In … Read more
This is the minimal automatic setup of an HTTPS server using Go and Let’s Encrypt certificates I have found: package main import ( “crypto/tls” “log” “net/http” “golang.org/x/crypto/acme/autocert” ) func main() { certManager := autocert.Manager{ Prompt: autocert.AcceptTOS, HostPolicy: autocert.HostWhitelist(“example.com”), //Your domain here Cache: autocert.DirCache(“certs”), //Folder for storing certificates } http.HandleFunc(“/”, func(w http.ResponseWriter, r *http.Request) { w.Write([]byte(“Hello … Read more
So I did some research and now I have a very basic example of a working VCR proxy server, that handles HTTPS calls as a MITM proxyserver (if you deactivate the security check in your client). I would be very happy if someone could contribute and help me to bring this thing to life. Here … Read more
It is generally bad practice to embed an iframe with content served over HTTPS within a page served over plain HTTP (or mix content). The reason for this is that there’s no good way for the user to check they’re using the HTTPS site they intend (unless the user really wants to check the source … Read more
For some reason Angular would send all requests over HTTP if you don’t have a tailing / at the end of your requests. Even if the page itself is served through HTTPS. For example: $http.get(‘/someUrl’).success(successCallback); // Request would go over HTTP even if the page is served via HTTPS But if you add a leading … Read more