Spotter Network Security Risk: no http->https redirection on spotternetwork.org

[James Hammett]

I noticed http://www.spotternetwork.org/login doesn't redirect to https. This is a security risk since it's prompting you to enter your credentials over an insecure connection. The SpotterNetwork app links to http rather than https for reporting so each time I have to change the URL before logging in.

 

[John Wetter]

Thanks James. Yes, we had a redirect there but it was causing other issues. The latest version of the SN app sends all data via HTTPS.

 

[James Hammett]

Ah, I figured the newer app might link to HTTPS. Unfortunately I had a problem with it and had to revert. Don't recall exactly what it was but it involved dependencies and a ton of errors popping up.

 

[James Hammett]

Is 3.1.4 the latest? Because I'm getting the insecure page to login when clicking Submit Report still even after updating:

 

[John Wetter]

Hi James, thanks for the information. We can't do an auto re-direct right now due to some old code some of our partners are using. You definitely can use https though. The 3.1.4 client sends the information via https. We already have plans in the works for retooling this in the off-season this year.