Incorrect SSL forwarding when calling steemnova.intinte.org -> No secure connection
Expected behavior
If I want to play the Steemit Variant of the online classic Ogame, I expect a secure connection. Since it is common nowadays and there is a secure connection to the web pages with log-in function I would wish that steemnova.intinte.org is also secured in the future. SteemNova should always redirect its connections immediately to a secure connection.
Actual behavior
Currently it is possible to open the page with an unsecured / unsafe connection There is an active SSL certificate, but the website does not automatically redirect to the secure connection.
If you want to play the game in a public coffee or WLAN hotspot, for example, it might be possible to get the login data in plain text for someone who is on the same network, and thus the security of your own data is not guaranteed.
How to reproduce
Just go to the website of SteemNova Moons Ogame Steem Edition:
- Non Secure Version:http://steemnova.intinte.org
- Secured Version: https://steemnova.intinte.org
- Or just go to the non secured Login Page and type the https at the beginning of the url
- Browser: All Browser
- Operating system: All Browser Systems
Recording Of The Bug
Example of existing SSL Certificate
Non secured Website Alert on enter Text in Forms
Screenshot from .har File of Website http://steemnova.intinte.org/index.php?page=login after Login
thank you
Posted on Utopian.io - Rewarding Open Source Contributors