HTTPS should be mandatory for any kind of authentication, demo or not about tailwindtraders-website HOT 5 CLOSED

Azure App Services is not the issue here, our public endpoints right now don't include SSL, we have this in our backlog and we will re-deploy the backend services with SSL certificate to support HTTPS as soon as possible. Meanwhile if you want to use the website with HTTPS you need to deploy the backend services with SSL and then change the app settings in the website to point to your own backend services.

from tailwindtraders-website.

Thanks David. SSL is a very sensitive issue - especially when sending authentication information over the wire, even for a demo. Does this:

our public endpoints right now don't include SSL

mean that you're not using Azure's App Services? I see the backend bits are in AKS and I can't say I fully understand what goes where (though I'm trying). Do we own the domains you're using or are they 3rd party?

from tailwindtraders-website.

Thanks @robconery. On January we will be adding a new public endpoints (backend) with a SSL certificate so we can use HTTPs in the public website without having to deploy the backend services. Assigning @eiximenis to this issue for creating the new environment.

from tailwindtraders-website.

Was this closed based on a code fix? I'm looking but can't tell if ssl is required.

from tailwindtraders-website.

Hi @robconery

Backend now supports TLS through cert-manager and let's encrypt, so now it is possible to deploy a backend environment with https :)

Additionally is also possible to deploy the web inside the AKS instead of using app service (although this is not related about the https issue).

Instructions about enabling TLS in Backend are in https://github.com/Microsoft/TailwindTraders-Backend/blob/master/Documents/DeploymentGuide.md#enabling-ssltls-on-the-cluster

from tailwindtraders-website.