Skip to content
This repository has been archived by the owner on Nov 6, 2023. It is now read-only.

Certain features on Steam Community sites break when using https #1911

Closed
NJC2 opened this issue Jun 11, 2015 · 7 comments
Closed

Certain features on Steam Community sites break when using https #1911

NJC2 opened this issue Jun 11, 2015 · 7 comments

Comments

@NJC2
Copy link

NJC2 commented Jun 11, 2015

There are some problems when using the Steam Community (steamcommunity.com) site with https. One that I run into most often is screenshots not loading. When viewing forums, the screenshot thumbnails load, but when you click one to see the larger size and details, it never loads.
steamssnoload

It's not entirely an https-everywhere problem because disabling https-everywhere and manually going to https://steamcommunity.com I still have this problem, but the only way around the problem is to completely disable https-everywhere because it forces steamcommunity.com to use https.

I wish I could disable https-everywhere for specific sites instead of globally disabling rules. I usually end up disabling the addon completely and then forgetting to re-enable it.

@reedy
Copy link
Contributor

reedy commented Jun 12, 2015

See also #1453 and #1702

@NJC2
Copy link
Author

NJC2 commented Jun 12, 2015

I have already seen those. Those are problems with the Steam store (store.steampowered.com), this is a dealing with the Steam Community site (steamcommunity.com). It also can't be solved by disabling rules as certain parts of steamcommunity.com just don't work at all using https. Currently the only way to use the Steam Community is to completely disable the addon because it always forces you to https.

@reedy
Copy link
Contributor

reedy commented Jun 12, 2015

I know, and I didn't say they were duplicates.

Though, I imagine most of the issues come from the cdn/akamai rewrites

Mixed Content: The page at 'https://steamcommunity.com/#scrollTop=1500' was loaded over HTTPS, but requested an insecure image 'http://images.akamai.steamusercontent.com/ugc/711914012598753408/F70D59485BBE5DCDBCF197AAABA07BFD973B6535/'. This content should also be served over HTTPS.
    <rule from="^http://cdn\.akamai\.steamstatic\.com/"
        to="https://steamcdn-a.akamaihd.net/" />

@Tailszefox
Copy link

The Monster Summer game, hosted on steamcommunity.com, is also completely broken when using HTTPS: it loads, but just sits there failing to get any assets.

The only way to play is to disable both the Steamcommunity rule and the Akamai rule, or disable HTTPS Everywhere entirely. Only disabling one or the other doesn't work.

From the console:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://steamapi-a.akamaihd.net/ITowerAttackMiniGameService/GetPlayerData/v0001/?gameid=11399&steamid=XXX&include_tech_tree=1&format=protobuf_raw. (Reason: CORS header 'Access-Control-Allow-Origin' missing).

@pde
Copy link
Contributor

pde commented Jun 18, 2015

@pde
Copy link
Contributor

pde commented Jun 18, 2015

I'm going to disable all of the Steam rulesets for now.

pde added a commit that referenced this issue Jun 18, 2015
Unil a fix for #1911 is
arranged.
@reedy
Copy link
Contributor

reedy commented Jun 28, 2015

Closing issue as steam rulesets disabled

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants