= bug description = ask.fedoraproject.org loads javascript from http://ajax.googleapis.com/, http://fonts.googleapis.com/ and http://connect.facebook.net/.
Recent versions of Chrome block these scripts when the site is accessed over HTTPS.
Besides for the login buttons not working, the only indication of the block is if you open the developer console: {{{ [blocked] The page at https://ask.fedoraproject.org/account/signin/ ran insecure content from http://fonts.googleapis.com/css?family=Yanone+Kaffeesatz:300,400,700. [blocked] The page at https://ask.fedoraproject.org/account/signin/ ran insecure content from http://ajax.googleapis.com/ajax/libs/jquery/1.4.3/jquery.min.js. [blocked] The page at https://ask.fedoraproject.org/account/signin/ ran insecure content from http://connect.facebook.net/en_US/all.js. Uncaught ReferenceError: jQuery is not defined utils.js:71 Uncaught ReferenceError: $ is not defined /account/signin/:218 Uncaught ReferenceError: jQuery is not defined jquery.validate.min.js:16 Uncaught ReferenceError: $ is not defined jquery.openid.js:1 Uncaught ReferenceError: $ is not defined /account/signin/:343 Uncaught ReferenceError: $ is not defined /account/signin/:345 }}}
= bug analysis = All of these services support HTTPS access. It would be proper to use it.
= fix recommendation = Removing protocols from script URLs (i.e. {{{src="http://ajax.googleapis.com/..."}}} becomes {{{src="//ajax.googleapis.com/..."}}})
You should be able to log in using Chrome now using all methods except Facebook.
The version of Askbot we're using ships with a jquery-openid that calls an old Facebook Connect API method that no longer exists. It's been fixed in upstream's git. Firefox seems to ignore the invalid API call and truck on. Chrome seems to not do anything. :(
As far as the other auth methods, they should work again. I'll try working with upstream to make external resources that it uses use https:// instead of http://.
Great. I was able to log in. It looks like all that is left that is not secure are the Gravatar pictures (which Chrome shows) and the Google Plus button (which Chrome blocks).
Login to comment on this ticket.