CUNY Academic Commons

Scott Dexter writes:

"Sorry for the delay; was away from the interwebs over the weekend. I guess I can’t post directly on redmine, but here’s some info which might help.
I have a hidden group on the Commons (called “Computational Problems in the Digital Humanities”) to which the wp blog is attached. Here’s an example of what happens when things go awry.
1) I log in to the Commons and go to the group main page.

2) I click on the “Site” link in the left sidebar. This brings me to the WP site main page with no problem.

3) When I click a link for a particular post—say, the post “Image is Everything” at URL http://cpdh.commons.gc.cuny.edu/2015/09/15/images/ <http://cpdh.commons.gc.cuny.edu/2015/09/15/images/&gt;, I’m asked to supply username and password:
4) My Commons credentials do not work here. If I try them repeatedly, I either get a error message about a redirect loop or a 401:
Also, the same thing happens when I click a link to “Leave a Reply” on a post, e.g. http://cpdh.commons.gc.cuny.edu/2015/09/09/whats-my-academic-super-power/#respond <http://cpdh.commons.gc.cuny.edu/2015/09/09/whats-my-academic-super-power/#respond>
(Oddly, when I set the site up, I specified it be visible only to registered members of the group, but that’s easily adjusted once this gets sorted out.)
Thanks very much"

Matt, do you have objections to getting an account set up for Scott?

Scott (Voth) - Let Scott (Dexter) know that I'm a big fan of Decoding Liberation. Also, let him know the following:

- I'm still unable to reproduce the issue.
- The HTTP authentication prompt won't accept Commons credentials, so that in itself is not a bug. (The bug is that the prompt shows up at all.)
- Is this always happening from the same network/IP address? A quick scan of recent requests suggests that it's from the same IP address. It's possible that something weird is happening with a network proxy that's tripping a rule on the Commons server.
- I've spent a bunch of time combing the ModSecurity logs and other Apache error logs to find some correlation, but I can't pinpoint any specific security rule that's being triggered.
- One thing that jumps out at me is the Upgrade-Insecure-Requests header. Does Scott have any browser settings or extensions meant to force HTTPS when available? (like HTTPS Everywhere) If so, does disabling make this problem go away?

If we can't figure this out from the semi-random questions above, I'll escalate to GC IT to see if they can help.

Matt, do you have objections to getting an account set up for Scott?

None at all!

Scott (Dexter): I created a Redmine account for you and set you up as a watcher on this ticket. You should now be able to update it directly.

Hi Scott - A quick ping to see whether you're continuing to have the problems described in this ticket.

Nope--the gremlin seems to have moved on. The theory that "It's possible that something weird is happening with a network proxy that's tripping a rule on the Commons server," isn't a bad one; I haven't been able to reproduce the problem for a couple months myself. (But I appreciate all the attention to the weirdness!)