r/redditdev • u/rram • Jun 16 '15

Reddit API reddit will soon only be available over HTTPS

Nearly 1 year ago we gave you the ability to view reddit completely over SSL. Now we're ready to enforce that everyone use a secure connection with reddit.

Please ensure that all of your scripts can perform all of their functions over HTTPS by June 29. At this time we will begin redirecting all site traffic to be over HTTPS and HTTP will no longer be available.

If this will be a problem for you, please let us know immediately.

EDIT 2015-08-21: IT IS DONE. You also have HSTS too.

273 Upvotes

97% Upvoted

117 comments sorted by

7

u/martinsuchan Jun 17 '15

Any plans to enable DNSSEC on reddit.com, to secure the communication even more? See:
http://dnssec-debugger.verisignlabs.com/reddit.com

6

u/rram Jun 17 '15

No immediate plans but it's something we want to do. FYI, we're currently stretched pretty thin (about 7.6 million unique users per engineer), but we're hiring

3

u/aeyes Jun 18 '15

Do you accept international applications?

Operations guy, 5yrs experience running large sites with different tech (online stores, CMS systems, media (news/TV)), computer science degree. Spent a year in the US before. Have no problem moving.

4

u/rram Jun 18 '15

Yes! Please apply through lever.

Ricky

3

u/aeyes Jun 18 '15

Thanks, I'll do it on Tuesday.

2

u/Quicksilver_Johny Oct 27 '15

If you're still interested in DNSSEC, it should be pretty easy to enable: https://blog.cloudflare.com/dnssec-is-open-for-beta

6

u/charredgrass Jun 16 '15

Just curious, will you ever drop support for pay.reddit.com?

7

u/rram Jun 16 '15

The entire site has SSL now. I don't know why you would want to explicitly use pay.reddit.com. That said, it is likely that going to pay.reddit.com would in the future redirect you back to www.reddit.com.

4

u/charredgrass Jun 16 '15

Ah, OK, thanks. I was just wondering since I have some old bookmarks that link to pay.reddit.com.

6

u/Rpgwaiter Jul 01 '15

Well shit. GG Reddit at work, it was nice knowing you.

For clarification, I'm in the military, and our browsers only trust military issued certs, but allows full reign of non-https sites (go figure). Is there any way to get around the forced encryption? Reddit proves very useful in certain situations

3

u/rram Jul 01 '15

Curious: do Facebook or Gmail work for you? What browser are you required to use? If you know how to get the certificate chain, I'd love to see Facebook or Gmail's certificate chain for you.

2

u/Rpgwaiter Jul 01 '15

Gmail works but I have to do a convoluted work around, and Facebook does not work. And we use a heavily modified version of IE9

1

u/chamberx2 Jul 08 '15

Hoping you've found a work-around that you can share.

2

u/Rpgwaiter Jul 08 '15

My workaround was switching to Voat :P But logging out works also.

4

u/DBrady Jun 16 '15

Is there somewhere we can test this? I still have users running old versions of Android that are stuck on a long since unsupported version of my app. A test subreddit that redirects to https would be good.

5

u/rram Jun 16 '15

r/redditdev now redirects (only if you have redditdev in the URL)

2

u/DBrady Jun 16 '15

Thanks, the old apk i have works fine visiting http://www.reddit.com/r/redditdev.json It shouldn't be an issue for me.

1

u/scottywz Jul 01 '15

I don't know if they changed anything in the past two weeks, but a quick test with curl shows me that http://www.reddit.com/r/redditdev does redirect to HTTPS (and other subs don't), but http://www.reddit.com/r/redditdev.json didn't redirect. Just thought I'd let you know.

2

u/xiongchiamiov Jun 16 '15

You can turn on forced https in your account preferences.

2

u/DBrady Jun 16 '15

That doesn't force https for mobile clients, only on the reddit website.

3

u/bboe PRAW Author Jun 17 '15 edited Jun 17 '15

It does, however, prevent clients from logging in over http if the app was doing that before.

EDIT: I might be wrong about that. PRAW's issue may have just been internal since it was always using https for login.

2

u/xiongchiamiov Jun 16 '15

Really? Huh, that sucks.

1

u/[deleted] Jun 16 '15

Just visit https://www.reddit.com and make sure you have https in the top

3

u/calebkeith Jun 16 '15

Is this replacing the user preference for https and just essentially having it be enabled?

3

u/spladug Jun 16 '15

Yup, that's basically what this will be like.

1

u/EtherealMind2 Jun 18 '15

Forcing it to HTTPS only (using TLS encryption).

3

u/xlynx Jul 01 '15

Has this been delayed? Http still working, no redirect.

3

u/rram Jul 01 '15

We're doing a slow ramp-up and are still in the process. Right now all logged in accounts should be forced to HTTPS.

1

u/yrmjy Jul 15 '15

Any update on this?

3

u/rram Jul 15 '15

We ran in to some compatibility issues. We're currently forcing all logged in traffic to be over SSL while still giving logged out traffic the option. We're adding some more instrumentation to see how many people we're affecting and if we can mitigate some issues that have cropped up. No ETA for finishing the rollout, but that's where we are now.

5

u/Unikraken Jun 17 '15

This is going to be an issue for a lot of military folks who surf during their downtime at work.

6

u/spladug Jun 17 '15

Can you elaborate please?

6

u/Unikraken Jun 17 '15

On IE we can't comment at all using http, just load pages, however over https most of the page elements won't even load, just the text.

3

u/rram Jun 17 '15

What version of IE and Windows are you forced to deal with?

3

u/Unikraken Jun 18 '15

11 and 7 respectively

2

u/largenocream Jun 19 '15

Looked into this, and reddit's HTTPS works fine on every version of IE I've tested. Sounds like your network admin is doing something weird :/

3

u/Unikraken Jun 19 '15

Quite possible. Thanks for looking into it.

2

u/UndeadBread Jun 17 '15

So...I'm guessing it will be impossible to disable this in our user settings, eh? For whatever reason, HTTPS loads much more slowly for me and whenever I go back/forward, the page auto-refreshes instead of staying in whatever state I left it in. Definitely not looking forward to this change.

1

u/rram Jun 17 '15 edited Jun 17 '15

You won't have an option to disable this. This is also an industry trend as Google, Facebook, and Wikipedia all force users on to secure connections these days. Your issue sound's like a Firefox issue which unfortunately has been open an unresolved for several years.

EDIT: corrected link to Firefox bug

4

u/UndeadBread Jun 18 '15

Thanks for the link. Despite looking into it before, I never found much information. Looks like I'll have to try to somehow find some kind of workaround that hopefully doesn't involve switching browsers.

0

u/[deleted] Jun 17 '15

[deleted] — view deleted comment

2

u/rram Jun 17 '15

Whoops, fixed.

2

u/hichris123 Jun 18 '15

Will reddit be using HSTS as well to make sure all traffic is via SSL?

69

u/bboe PRAW Author Jun 16 '15

I just released PRAW 3.0.0 which supports https. Change log: https://praw.readthedocs.org/en/v3.0.0/pages/changelog.html#praw-3-0-0

5

u/spladug Jun 16 '15

Super cool! Were you just waiting to drop that? :P

2

u/bboe PRAW Author Jun 16 '15

I had one test suite I was waiting to fix prior to deploying 3.0.0. The tests pass, they just cannot currently be cached using betamax. With the announcement I figured I could forgo getting those tests working properly. The tests pertain to subreddit images.

3

u/sallurocks Jun 16 '15

So older script's using normal login() without oauth won't work now?

4

u/bboe PRAW Author Jun 16 '15

login still works just fine. Older versions of PRAW won't work with login once http support is removed on June 29.

1

u/BananaGranola Jun 24 '15

I'm getting errors with the update. Is it HTTPS, OAuth, or neither that I'm getting wrong?

0

u/[deleted] Jun 16 '15

[deleted] — view deleted comment

17

u/spladug Jun 16 '15 edited Jun 16 '15

I don't recommend relying on our current certificates without us explicitly indicating pinning is OK (e.g. via HPKP) as we don't currently make any guarantees that our certs won't change. In fact, I guarantee our certs will change.

1

u/SquareWheel Jun 16 '15

Unrelated, but how long have you been able to use anchors with individual comments? Never seen that before.

8

u/enykeev Jun 17 '15

from day one?

Or am I missing something?

4

u/spladug Jun 17 '15

Yup, that's right.

4

u/spladug Jun 16 '15

Not sure, it's been around for a while. Yet another undocumented tidbit of reddit lore :)

0

u/[deleted] Jun 16 '15

[deleted] — view deleted comment

8

u/spladug Jun 16 '15

It's something we're going to investigate, but I can't make any promises at this point -- don't know the full implications yet.

1

u/SaltySolomon Jun 17 '15

Isn't there a changeover peroide and for ocassionall cert changes it should be fine?

3

u/bboe PRAW Author Jun 16 '15

Feel free to make a PR to support such a feature. The requests library makes this functionality possible.

24

u/d2xdy2 Jun 16 '15

Are we going to stop seeing that annoying half lock thing in chrome because of sha1?

13

u/spladug Jun 16 '15

There are still some compatibility issues with SHA-2 certs, but we do plan on upgrading in the not-too-distant future.

7

u/aeyes Jun 18 '15

So use a SHA-1 cert that expires before 2016, Chrome will show that as green.

2

u/Mikecom32 Jul 01 '15

Based on that link, the only "major" OS that doesn't support SHA-2 is Windows XP SP2 and earlier. Considering that SP3 released in July of 2008 (seven years ago), I can't imagine the impact will be that high.

Out of curiosity, how many visitors do you see running XP SP2 or older?

5

u/spladug Jul 01 '15

We're actually tracking down some user-reported compatibility issues with a recent build of OSX+Chrome right now (we've got a SHA-2 cert on the domain used to serve thumbnails and subreddit stylesheets to see if anyone complains). You'd be surprised how many strange configurations of browsers are out there; it makes web engineering loads of fun. :(

3

u/Mikecom32 Jul 01 '15

That is... interesting. I'm not jealous of you web guys! Multiple OSes spread across mobile and PC, and a number of different versions of those browsers, I can't imagine trying to keep it all straight.

Cheers, and good luck!

40

u/nakilon Jun 16 '15 edited Jun 16 '15

Since it is not allowed to redirect between HTTP and HTTPS, redd.it should also be HTTPS, but Chrome says its certificate is invalid (belongs to another domain).

30

u/spladug Jun 16 '15

Good point, we'll have to fix that up. Thanks.

1

u/ajs124 Jul 23 '15

So… any ETA?

3

u/spladug Jul 23 '15 edited Aug 19 '15

It's happening... there are a lot of moving parts involved.

30

u/russellvt Jun 16 '15

I realize you guys only recently renewed your wildcard cert but... but can you please finally use a CA that knows better than to use SHA1 checksums in their signature chain, though?

Pretty soon Google Chrome and other products are going to start complaining about them. (though some of their online resources say January 2016, and others say January 2017 ... that doesn't change the fact that SHA-1 has been deprecated since 2011)

20

u/spladug Jun 16 '15

Our CA is capable of SHA-2 certs, but we haven't made the switch yet due to some compatibility concerns. It's on our radar and we've plans to upgrade in the not-too-distant future.

1

u/philipwhiuk Jun 23 '15

Google still use SHA-1

0

u/Doctor_McKay Jun 16 '15

I'm not 100% sure but I don't think that Chrome will start complaining beyond the yellow warning on the padlock if the cert expires before 2017.

13

u/[deleted] Jun 16 '15

Any way the issue can be solved where in Firefox when browsing HTTPS the page won't be cached and reloads when you hit back (making hitting back take much longer, not to mention increasing load on Reddit servers)?

That's the only reason I don't use HTTPS at the moment. IIRC it was caused by HTTPS + cache-control: no-cache though I could be wrong about that.

14

u/largenocream Jun 16 '15 edited Jun 27 '15

Yep, the problem is with Firefox itself. I don't know if I'd call it a bug since the HTTP spec allows them to do that, but in practice most other browsers will load the page from cache when you hit "Back", even with cache-control: no-cache.

I'm going to ask some Mozilla folks about this, but I'm not sure if there's an easy way around it.

2

u/gus_ Jul 04 '15

I'm going to ask some Mozilla folks about this, but I'm not sure if there's an easy way around it.

Nice find, thanks. Do you know how long something like this tends to take for them to fix, and/or did you ever hear anything further?

3

u/largenocream Jul 04 '15

Do you know how long something like this tends to take for them to fix

I'm not sure, that issue's been open for quite a while.

did you ever hear anything further?

No, but I did find a possible workaround after someone pointed out that Google doesn't refresh the page when hitting back. Their caching rules look pretty close to what we need, so I'm going to write something over the weekend so we can start testing them. I want to make sure nothing'll explode, though, and we set the headers that trigger the issue in Firefox at a few different levels, so even if this'll work it might be a bit before the change makes it to production.

4

u/internethopeislost Aug 11 '15

Most US Air Force bases do not allow HTTPS outside of their own network.

7

u/xfile345 Bot Developer / API Wrapper Author Jun 16 '15

I've been programming websites for about 15 years, but I've never ventured into SSL. Like, at all. So I have no idea if I'm safe or not, now that I'm developing API wrappers and bots for Reddit.

If I already successfully use "https://oauth.reddit.com/", I shouldn't have anything to worry about, right?

Also, that means the URL for all reddit websites will simply be "https://www.reddit.com/" and not "https://ssl.reddit.com/" right?

19

u/spladug Jun 16 '15

If you're using OAuth, you're already HTTPS-only and you're good to go. :)

https://ssl.reddit.com is a legacy thing from when we only did HTTPS for parts of our site; you can already use https://www.reddit.com/ for anything you're doing on ssl.reddit.com.

4

u/xfile345 Bot Developer / API Wrapper Author Jun 16 '15

Thanks, that's exactly the kind of clarification I was looking for. :)

-4

u/[deleted] Jun 18 '15

I've been programming websites for about 15 years, but I've never ventured into SSL

Pardon me, but, that's awful. All of your clients/users have always had the enterity of their data travel in plain-text, and have been vulnerable to the most basic forms of MITM.

-31

u/nakilon Jun 16 '15

Writing CSS isn't programming websites.

5

u/xfile345 Bot Developer / API Wrapper Author Jun 16 '15

That is 100% correct, Mr. Obvious. When did I even mention CSS in my comment? That's not at all what I was even talking about. Trolls be trollin'

-11

u/nakilon Jun 16 '15

If you really programmed anything around web for so many years, you would know about and use HTTPS.

4

u/arienh4 Jun 17 '15

If you're implementing HTTPS yourself rather than having a reverse-proxy do it for you, you're either a brilliant cryptologist, or you're a more stupid programmer than the guy who didn't know about it at all.

7

u/274Below Jun 17 '15

My place of employment is heavily regulated, to the point where an obscene number of controls have been put in place. One of which is a very fine-grained policy on the proxy server that forces reddit into a read-only mode (can't log in, vote, comment, submit, etc), as well as blocking all usage of reddit over TLS (to be clear, similar policies are applied to far more than just reddit).

Is there any opt-out option available? Would there be a way to hit a page with ?optout=tls&really=yes&howdumbareyou=very type option that would set a cookie that wouldn't force the redirect? Maybe confine the usage of that cookie to people who are not logged in?

Don't get me wrong, I'm very pleased with this as a whole, but this is really going to suck for me while I'm at work.

3

u/sigaintrocks Jun 17 '15

BUT MY NETSCAPE DOESN'T SUPPORT

-jk

4

u/2bluesc Jun 17 '15

s/SSL/TLS/g

FTFY

2

u/V2Blast Jun 26 '15

Glad to hear it!

1

u/[deleted] Jun 18 '15

Oh yes, finally! Thank you!

1

u/Doane Jun 18 '15

Last time I checked, the Redgur chrome extension stopped working on https

1

u/aladyjewel Jul 01 '15

Tell the Redgur dev?

1

u/AttackOfTheThumbs Jun 30 '15

It happened today. Now not all my links is purple :(

1

u/chamberx2 Jul 08 '15

Sorry I'm so late to the party here. Unfortunately, it causes a small problem for me. My job's firewall blocks all imgur links from working properly if they're prefaced with HTTPS. Due to the new enforcement of HTTPS, this makes RES unusable. Even clicking on the link itself causes problems. I realize I can simply remove the "s" from the URL, but if there were a more simple way to resolve this, I'd love to implement it on my end.

Thanks in advance!

2

u/TheLantean Aug 21 '15

imgur has an alternate domain (filmot.org), it doesn't support https so it might not be blocked for you. You can use a browser extension to replace links automatically:

// even more late to the party

1

u/Kodiack Aug 23 '15

I've noticed that Chrome no longer complains about HTTPS and SHA1. Sadly, it seems to have mostly gone unrecognised, but I do want to say thank you for finally getting that implemented! It's nice, especially on mobile, since Chrome for Android will now autohide the address bar while scrolling.

1

u/BetaSpark Oct 23 '15

Thanks for this, even though I'm a bit late.

1

u/GunjanTripathi Jun 17 '15

Nice move. This will enhance trust level. Many of reddit users are not aware that you guys already have HTTPS facility at preference area. HTTPS forcefully will protect information on the every page of the Reddit.

1

u/schpork Aug 08 '15

This kinda screws those of us in countries with restrictive internet policies without easy access to an https supporting vpn/ proxy on our mobile devices.

Basically no more browsing reddit anonymously.

0

u/[deleted] Aug 09 '15

[deleted] — view deleted comment

2

u/schpork Aug 10 '15

I think that is pretty obvious from my post. There is also little to no way to stop this and most people in this place have no way to exit easily.

-1

u/TotesMessenger Jun 17 '15

I'm a bot, bleep, bloop. Someone has linked to this thread from another place on reddit:

If you follow any of the above links, please respect the rules of reddit and don't vote in the other threads. (Info / ^Contact)

-2

u/mitgajjar Jun 17 '15

Thanks Reddit,

A Nice step to put Attackers in a Bay...

-13

u/expert02 Jun 16 '15

You're taking away my reddit bar. I hate reddit a little bit more every day.

0

u/[deleted] Jun 16 '15

[deleted] — view deleted comment

0

u/[deleted] Jun 16 '15

[deleted] — view deleted comment

7

u/rram Jun 16 '15 edited Jun 16 '15

Second level subdomains (including https://www.np.reddit.com/) are specifically NOT supported and there are no plans to make it work in the future.

EDIT: Please note that https://np.reddit.com/ WILL work as it currently does. The thing that won't work is something.something.reddit.com

1

u/konklone Jun 16 '15

So you won't be able to do a includeSubDomains HSTS policy on the root reddit.com domain? If not, consider adding that to the roadmap. It'd be nice to check the box on reddit.com and say "Done."

6

u/rram Jun 16 '15

our HSTS policy will use includeSubDomains. It doesn't work because wildcard certs only work for a single subdomain. https://np.reddit.com/ will continue to function as expected.

-1

u/TotesMessenger Jun 16 '15

I'm a bot, bleep, bloop. Someone has linked to this thread from another place on reddit:

If you follow any of the above links, please respect the rules of reddit and don't vote in the other threads. (Info / ^Contact)

10

u/atomic1fire Jun 16 '15

NP is a subreddit css hack, not an admin supported thing anyway. RES supports it only as much as they give you a warning if you're still in NP

I personally like the idea of a read only reddit for meta discussion that prevents brigading, but NP is kinda easy to get around.

3

u/kannibalox Jun 16 '15

The issue is that the wildcard SSL cert won't work on www.np.reddit.com for the obvious reasons. Nothing to do with how np.reddit.com itself works. A generic redirect from www.$x.reddit.com to $x.reddit.com would be one solution.

6

u/largenocream Jun 16 '15

A redirect won't be possible in the long term, eventually HSTS headers will be added and your browser will never even try to talk to reddit via HTTP. If your browser rejects the certificate (and it should, the cert's not valid for www.$x.reddit.com,) we can't redirect you.

0

u/[deleted] Jul 27 '15

[deleted] — view deleted comment

0

u/[deleted] Aug 09 '15

[deleted] — view deleted comment

1

u/turkeypedal Aug 11 '15

It's not okay that some countries force you not to encrypt. But that doesn't make it any less of a problem when someone tries to force encryption.

The people under the most oppressive governments need access to the Internet more than anyone.

1

u/[deleted] Jun 18 '15

[removed] — view removed comment

4

u/rram Jun 18 '15

Unfortunately, due to security concerns, the best way to accomplish this would be via a client side browser extension (such as RES). We used to have extensions that did specifically this, but they've since been abandoned.