Uploaded image for project: 'MusicBrainz Server'
  1. MusicBrainz Server
  2. MBS-5347

acoustid API isn't available nor requested over https, so on https musicbrainz-server acoustids don't appear

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Normal Normal
    • 2012-10-01
    • None
    • Data display
    • None

      https://api.acoustid.org first shows a cert for www.acoustid.org, and then it redirects to acoustid.org. No API results at any point. http://api.acoustid.org (which is what's currently in the scripts) gets rejected as loading insecure content via XHR, at least by my browser.

      So, two things need to happen:

      a.) acoustid API needs to be accessible over https with a valid certificate
      b.) MBS needs to use scheme-relative links for loading acoustid API data in root/recording/fingerprints.tt

          [MBS-5347] acoustid API isn't available nor requested over https, so on https musicbrainz-server acoustids don't appear

          Ian McEwen added a comment -

          Fix version wasn't added for some reason, so this wasn't closed.

          Ian McEwen added a comment - Fix version wasn't added for some reason, so this wasn't closed.

          Ian McEwen added a comment -

          http://codereview.musicbrainz.org/r/2345/

          Ian McEwen added a comment - http://codereview.musicbrainz.org/r/2345/

          Lukáš Lalinský added a comment -

          Should work now. It uses SNI, so MSIE users on Windows XP still get the www.acoustid.org certificate, but I can live with that.

          https://api.acoustid.org/v2/track/list_by_mbid?format=xml&mbid=c03e05a3-3f6b-4f3a-93ef-66057786d072

          Lukáš Lalinský added a comment - Should work now. It uses SNI, so MSIE users on Windows XP still get the www.acoustid.org certificate, but I can live with that. https://api.acoustid.org/v2/track/list_by_mbid?format=xml&mbid=c03e05a3-3f6b-4f3a-93ef-66057786d072

          Lukáš Lalinský added a comment -

          I totally forgot that it's using JSONP to fetch the data. In that case, yes, HTTPS is probably a must. I'll have a look at that.

          Lukáš Lalinský added a comment - I totally forgot that it's using JSONP to fetch the data. In that case, yes, HTTPS is probably a must. I'll have a look at that.

          Ian McEwen added a comment -

          To my knowledge, that'd be the only way to have the acoustid listings work on an https musicbrainz (except of course if we start pulling acoustid information and reading from our own database). What's your concern with enabling the API over https?

          Ian McEwen added a comment - To my knowledge, that'd be the only way to have the acoustid listings work on an https musicbrainz (except of course if we start pulling acoustid information and reading from our own database). What's your concern with enabling the API over https?

          Lukáš Lalinský added a comment -

          Hm, I'm not sure if I want to allow HTTPS for the API.

          Lukáš Lalinský added a comment - Hm, I'm not sure if I want to allow HTTPS for the API.

          Ian McEwen added a comment -

          Assigning this to luks for step 1 – feel free to pester me if you want a tester/SSL auditor/whatever though

          Ian McEwen added a comment - Assigning this to luks for step 1 – feel free to pester me if you want a tester/SSL auditor/whatever though

            ianmcorvidae Ian McEwen
            ianmcorvidae Ian McEwen
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

              Created:
              Updated:
              Resolved:

                Version Package
                2012-10-01