[pdbe-api-users] 1 October: HTTPS by default for PDBe REST API

Jalview Developers
1

Not sure if this will have an impact on Jalview.

Probably not at all, if our requests do not have a referer domain of www.ebi.ac.uk.

Currently

PDBFTSRestClient.PDB_SEARCH_ENDPOINT = "http://www.ebi.ac.uk/pdbe/search/pdb/select?";

I tried changing this to https and it worked fine. The site has a QuoVadis certificate which I guess should be trusted by all users.

I suggest we change this constant to https for the next release.

I’m less sure of how Jalview’s (Jersey WebResource.accept()) code would handle a 302 redirect, if that is what happens on 1st October.

Googling suggests some people have had trouble with this, even after setting a config property FOLLOW_REDIRECTS.

Mungo

The University of Dundee is a registered Scottish Charity, No: SC015096

ATT00001.txt (166 Bytes)

···

Email signature

University of Dundee shield logo

Mungo Carstairs
Jalview Computational Scientist

The Barton Group
Division of Computational Biology

School of Life Sciences

University of Dundee, Dundee, Scotland, UK

www.jalview.org

www.compbio.dundee.ac.uk
g.m.carstairs@dundee.ac.uk

University of Dundee FacebookUniversity of Dundee TwitterUniversity of Dundee LinkedInUniversity of Dundee YouTubeUniversity of Dundee InstagramUniversity of Dundee Snapchat
We’re Scottish University of the Year again!
The Times / Sunday Times Good University Guide 2016 and 2017

From: pdbe-api-users-bounces@ebi.ac.uk pdbe-api-users-bounces@ebi.ac.uk on behalf of Nurul nurul@ebi.ac.uk
Sent: 21 September 2017 09:46
To: pdbe-api-users@ebi.ac.uk
Subject: [pdbe-api-users] 1 October: HTTPS by default for PDBe REST API

Hi all,

In October the new version of Chrome will increase its assertiveness in telling users that they are ‘not secure’ when accessing pages on HTTP rather than HTTPS.

The web development team at EBI thus decided to make the www.ebi.ac.uk HTTPS by default (e.g. redirect users from HTTP to HTTPS) from 1 October.

This means that if you use the PDBe REST API from the www.ebi.ac.uk domain, you will be automatically redirected from http://www.ebi.ac.uk/pdbe/api/ → https://www.ebi.ac.uk/pdbe/api/

Another reminder about this change will be sent in 5 days.

Best regards,
Nurul

2

Not sure if this will have an impact on Jalview.

Probably not at all, if our requests do not have a referer domain of www.ebi.ac.uk.

not absolutely sure what you mean there…

Currently

PDBFTSRestClient.PDB_SEARCH_ENDPOINT = “http://www.ebi.ac.uk/pdbe/search/pdb/select?”;

I tried changing this to https and it worked fine. The site has a QuoVadis certificate which I guess should be trusted by all users.

I suggest we change this constant to https for the next release.

Yes. 2.10.2b1 could also be patched right now.

I’m less sure of how Jalview’s (Jersey WebResource.accept()) code would handle a 302 redirect, if that is what happens on 1st October.

Googling suggests some people have had trouble with this, even after setting a config property FOLLOW_REDIRECTS.

I would expect this is a common issue (if it really is one) - perhaps check for updates to Jersey ?

Also, we need to test the other clients in Jalview - particularly for our own services. The plan is to apply redirects for www.compbio.dundee.ac.uk, and ideally also *.jalview.org (we already have this for issues and wiki, and source (ish), but also need to do it for www.jalview.org). Could you ask Fabio about getting a test jabaws service set up under https with a redirect on http to see what happens with the Jabaws client ?

Thanks,
Jim

The University of Dundee is a registered Scottish Charity, No: SC015096

···

On 21/09/2017 10:52, Mungo Carstairs (Staff) wrote: