Forums
All Springshare products moving to HTTPS 7/15/2020 - Printable Version

+- Forums (https://libforum.vccs.edu/forum)
+-- Forum: Web Liaisons: Web and eResource management (https://libforum.vccs.edu/forum/forum-8.html)
+--- Forum: LibGuides (https://libforum.vccs.edu/forum/forum-21.html)
+--- Thread: All Springshare products moving to HTTPS 7/15/2020 (/thread-3478.html)

All Springshare products moving to HTTPS 7/15/2020 - tcassidy - 06-10-2020

Your college  may have received the message below from Springshare today. It's good idea to "spot check your content and.. update any embedded HTTP content to load over HTTPS instead. This content is likely already failing to load due to browser security updates over the last several months."

Personally, I would focus on the most likely trouble spots, embedded search boxes and media content. If there's going to be a problem as a result of forcing HTTPS connections, it's likely already broken. For instructions on how to test particular pages, please see the 'FOR ACTION' section in the message below.

--
"HTTPS Required for All Sites
 
Hello Admin,
You are receiving this email because you are an Admin level user in a LibGuides, LibAnswers, and/or LibCal system. This is an operational email to inform you about a change in our services, therefore there is no unsubscribe link.

As noted in the past, the web as a whole is moving toward a more secure user experience, and Springshare agrees with this move. To that end, we are updating all LibGuides, LibAnswers, and LibCal sites to require that all pages load over HTTPS by end of day Wednesday, July 15, 2020. All other Springshare apps already load all pages over HTTPS.

If you have already set your app(s) to require HTTPS, you can safely ignore this email. LibApps Admins can check your site list / HTTPS status:
  1. Log into LibApps directly, or log into any of your Springshare apps, then click the blue menu in the top left corner of the screen and choose LibApps.
  2. Go to Admin > Domains and Certificates.
    (If you do not see the Admin menu, you are not a LibApps Admin. Please contact your LibApps Admin to complete these steps.)
  3. Review the list of sites; if there is a check mark in the Force HTTPS column, your site is already requiring that all pages load via HTTPS.
    (Note: The page that allowed you to set your site to HTTPS Required was removed in preparation for this update.)
Most of you won't notice any difference, because you've already updated your embedded content and moved your site to require HTTPS.

For the sites who have not yet done this, you will need to spot check your content and make sure you update any embedded HTTP content to load over HTTPS instead. This content is likely already failing to load due to browser security updates over the last several months. (See our post from earlier this year about Chrome's planned updates to block http content from loading; their timeline changed somewhat due to COVID-19, but they are still planning/releasing these updates.)

Timeline
  • Region: Canada, Europe, Asia-Pacific - By end of day Friday, June 19, 2020.
  • Region: United States - By end of day Wednesday, July 15, 2020.
Check for Mixed Content
Mixed content is anything (like an image or search widget) on an HTTPS-loaded webpage that has an HTTP-based URL as the source. This content is blocked in most modern browsers if displayed on a secured (HTTPS) page. For example, if you have an image embedded in your HTTPS-loaded page, you need to make sure the URL in the "src" for the image is also loading over HTTPS.

While we plan to assist by automatically upgrading http:// requests to https://, that doesn't mean that all of that content will work once the URLs are changed. Whether or not it works all depends on the owner of that content / page. If the vendor or website owner does not support HTTPS for that page, widget, etc., then the content will not appear on the page.

FOR ACTION
Until we roll this automatic process out, and even after we do, you can plan for updating this content yourself! This applies mostly to widget content; simple links to HTTP sites eventually need to be updated, but this is less crucial.
  • Check your site by going to a page in your site, changing the URL to HTTPS, then reviewing content on the page to see if it all loads. Particularly look for widgets embedded on your pages.
    Protip! Go to Content > Assets and limit to Widgets/Media to see where you are using this content type in your guides.
  • If/when you find something that is loading over HTTP, you can try simply updating the source URL to HTTPS and see if that works. Since this move to all HTTPS has been going on for a few years now, most vendors have already updated their content to work using HTTPS.
  • If it does not work, please visit the vendor's website to see if you can generate secure, all HTTPS code. If they do not have anything available, you'll need to contact the provider of that content (i.e., the vendor or website owner) to see if they provide HTTPS-compatible code / website, or when they will. If they do not have an option and aren't planning to offer an option in the near future, you'll need to remove that content from your page until you can find a secure alternative. Unfortunately, this is not something our support team can help with, since we do not control other vendors' / institutions' products or websites.
Please share this message with your colleagues so they are aware of this update.
Thank you,
The Springshare Team"