{"action":"created","issue":{"url":"https://api.github.com/repos/18F/openFEC/issues/831","labels_url":"https://api.github.com/repos/18F/openFEC/issues/831/labels{/name}","comments_url":"https://api.github.com/repos/18F/openFEC/issues/831/comments","events_url":"https://api.github.com/repos/18F/openFEC/issues/831/events","html_url":"https://github.com/18F/openFEC/issues/831","id":80799769,"number":831,"title":"HTTP site still has basic auth activated","user":{"login":"NoahKunin","id":565071,"avatar_url":"https://avatars.githubusercontent.com/u/565071?v=3","gravatar_id":"","url":"https://api.github.com/users/NoahKunin","html_url":"https://github.com/NoahKunin","followers_url":"https://api.github.com/users/NoahKunin/followers","following_url":"https://api.github.com/users/NoahKunin/following{/other_user}","gists_url":"https://api.github.com/users/NoahKunin/gists{/gist_id}","starred_url":"https://api.github.com/users/NoahKunin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/NoahKunin/subscriptions","organizations_url":"https://api.github.com/users/NoahKunin/orgs","repos_url":"https://api.github.com/users/NoahKunin/repos","events_url":"https://api.github.com/users/NoahKunin/events{/privacy}","received_events_url":"https://api.github.com/users/NoahKunin/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/18F/openFEC/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-05-26T05:27:10Z","updated_at":"2015-05-26T13:13:50Z","closed_at":null,"body":"Should direct to HTTPS site instead.\r\n\r\ncc @LindsayYoung @leahbannon "},"comment":{"url":"https://api.github.com/repos/18F/openFEC/issues/comments/105521218","html_url":"https://github.com/18F/openFEC/issues/831#issuecomment-105521218","issue_url":"https://api.github.com/repos/18F/openFEC/issues/831","id":105521218,"user":{"login":"jmcarp","id":1633460,"avatar_url":"https://avatars.githubusercontent.com/u/1633460?v=3","gravatar_id":"","url":"https://api.github.com/users/jmcarp","html_url":"https://github.com/jmcarp","followers_url":"https://api.github.com/users/jmcarp/followers","following_url":"https://api.github.com/users/jmcarp/following{/other_user}","gists_url":"https://api.github.com/users/jmcarp/gists{/gist_id}","starred_url":"https://api.github.com/users/jmcarp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jmcarp/subscriptions","organizations_url":"https://api.github.com/users/jmcarp/orgs","repos_url":"https://api.github.com/users/jmcarp/repos","events_url":"https://api.github.com/users/jmcarp/events{/privacy}","received_events_url":"https://api.github.com/users/jmcarp/received_events","type":"User","site_admin":false},"created_at":"2015-05-26T13:13:50Z","updated_at":"2015-05-26T13:13:50Z","body":"The issue is that the basic auth check and the https redirect happen in the wrong order. When users who haven't previously authenticated hit http://open.fec.gov, they'll be prompted for basic auth credentials, then get redirected to https, then get prompted for credentials again. And the first batch of credentials won't be encrypted.\r\n\r\nThis should be as simple as reversing the order of the basic auth and sslify extensions. I'll take a look."}}