Products

Solutions

Resources

Partners

Community

Blog

About

QA

Ideas Test

New Community Website

Ordinarily, you'd be at the right spot, but we've recently launched a brand new community website... For the community, by the community.

Yay... Take Me to the Community!

Welcome to the DNN Community Forums, your preferred source of online community support for all things related to DNN.
In order to participate you must be a registered DNNizen

HomeHomeOur CommunityOur CommunityGeneral Discuss...General Discuss...Secure Login - Mixed BlessingSecure Login - Mixed Blessing
Previous
 
Next
New Post
7/16/2007 11:59 AM
 

Yes, if the IFrame source that the SourceForge logo is in was actually on the page when you get the mixed mode message then it would be a problem also, but you have corrected that by removing it from the page that has the SSL turned on.  You don't get a mixed mode message when you transfer to a page that does not have SSL, it only happens when you are on a page that has SSL and some of the content from that page is referenced on a non-secure layer.

There is a different kind of warning for when you navigate away from a page that has SSL to one that is not secure.  This is usually turned off by most people, but you can not correct that one by changing the output of your site.

I would disagree that the new SSL is handled correctly in DNN.  The multiple round trips to the server is far from optimal.


DotNetNuke Modules from Snapsis.com
 
New Post
7/25/2007 12:32 PM
 

I have done a complete analysis of the Javascript method you describe on your site and the implementation that we have in DotNetNuke and have shown how the DotNetNuke method is much more efficient.  If you have some other alternative we would be happy to evaluate it, but as of now, using server side redirects is clearly the most efficient method.


Joe Brinkman
DNN Corp.
 
New Post
7/25/2007 2:36 PM
 

jbrinkman wrote

I have done a complete analysis of the Javascript method you describe on your site and the implementation that we have in DotNetNuke and have shown how the DotNetNuke method is much more efficient.  If you have some other alternative we would be happy to evaluate it, but as of now, using server side redirects is clearly the most efficient method.

I too have come to that conclusion as well.  I am still looking for other ideas myself  as it does still appear to be slow at times, I'll post back here if I come up with anything.


-Mitchel Sellers
Microsoft MVP, ASPInsider, DNN MVP
CEO/Director of Development - IowaComputerGurus Inc.
LinkedIn Profile

Visit mitchelsellers.com for my mostly DNN Blog and support forum.

Visit IowaComputerGurus.com for free DNN Modules, DNN Performance Tips, DNN Consulting Quotes, and DNN Technical Support Services
 
New Post
7/25/2007 7:48 PM
 

Wow Joe. I'm beginning to wonder where your priorities are if you are spending all that time on a wild goose chase.

I never said the Javascript method was something that I thought should be implemented in DotNetNuke, as a matter of fact I explicitly stated in one thread that I was not advocating that approach be taken from within the application. I believe it adds too much overhead for the relatively small amount of sites that will actually need that functionality.

What I did say was that the implementation in dotnetnuke was not optimal, and that doing the multiple redirects was not efficient.

Since you did take the time to try and understand it though, I would be remiss if I didn't spend a little time to point out some problems I see in your analysis.

First off, on my site I am not using a POST on the initial request.  I have the link going directly to the site using https, but lets say that all someone did was implement the javas cript in question and the initial request was a POST like your analysis shows. 

You may not realize this, but in DNN 4.5.2 the Login skinobject was changed to be a command button so that postback processing could be done for the new returnurl feature.
So the redirect you are seeing after postback is in fact being caused by the server-side processing to add the returnUrl to the querystring. Again this is not the most optimal way of achieving that new feature.  It would be better to have left it as a hyperlink and on Page_Load add the returnurl to the querystring. 

So the first redirect that your analysis is showing for both methods is actually the server-side code of the login click method, not a 302 redirect from the client-side.  Can someone actually create a 302 redirect using location.href? Try this. Start up you favorite monitor and hit this link: http://www.snapsis.com?ctl=login. Did you record any 302 responses from the server? No, but it is sitting on a secure channel when we asked for a normal one.  Is it magic?  No, changing location.href from the client produces a GET request that is performed without a round trip to the server.

Now, I would expect that you not try to bias any of this thorough analysis you did by starting with the assumption that you have to be right, but the results you give on performance are pretty hard to believe from a high level view. Why would you ever consider that doing two round-trip redirects to the server would be faster than one redirect?  Doesn't that strike you as odd?  Is it because you believe that the payload delivered after the postback is slowing it down?  My guess is that you did your measurements without starting from a cold benchmark, so it just appears that your second method is faster. Anyone really looking at the data you produced can easily see this since the last 200 GET request on both methods is almost exactly the same in size, yet you show it taking longer.

Nice diagrams.

 


DotNetNuke Modules from Snapsis.com
 
New Post
7/25/2007 9:38 PM
 

John - My priorities are where they should be: making sure the community is getting the complete picture and is not just taking someone's word for it because they happen to post a lot to the forums. You have repeatedly said that the DotNetNuke SSL implementation is innefficient and you point people to your javascript tip as a better method - which it is not. The SSL implementation is completely independent of the login link implementation. In fact given that the two features were implemented in different releases just highlights this fact.  The configuration on your site for the login page is not related to the SSL implementation. Having a direct login page link is possible with or without SSL. I can create a login link on any DotNetNuke site that links directly to the login page without requiring a single change to any SSL code.  The only item that is different between the two SSL methods is how we redirect from HTTP to HTTPS. 

The very fact that you attempt to post more misleading information here just makes my point. If you go to the link http://www.snapsis.com?ctl=login your browser will issue an HTTP GET request on port 80 and will receive a complete page of 16342 bytes. This page will then change the location.href which will cause the browser to issue another GET request on port 443 which will recieve a second page of 16362 bytes. If this had used the SSL implementation from DotNetNuke then the first GET request would have resulted in in a 302 response of roughly 250 bytes. You completely ignored the analysis of the processing that occurs to build that first HTTP page you return, which the user never fully gets to see and which is therefore just wasted bandwidth usage. Using location.href is not magic. Your browser must still make a request back to the server to get the new page you have requested by changing the page location. So to answer your question no the browser is not causing a 302 redirect using your method. It is causing a whole request/response cycle which means rebuilding the whole page on the server and resending that page a second time using HTTPS. This is much less efficient than using a 302 redirect as indicated in my original analysis which you ignored.

I have not put any bias into my analysis which is why I included the raw XML in my Blog so that everyone could look at the raw numbers and come to their own conclusions.


Joe Brinkman
DNN Corp.
 
Previous
 
Next
HomeHomeOur CommunityOur CommunityGeneral Discuss...General Discuss...Secure Login - Mixed BlessingSecure Login - Mixed Blessing


These Forums are dedicated to discussion of DNN Platform and Evoq Solutions.

For the benefit of the community and to protect the integrity of the ecosystem, please observe the following posting guidelines:

  1. No Advertising. This includes promotion of commercial and non-commercial products or services which are not directly related to DNN.
  2. No vendor trolling / poaching. If someone posts about a vendor issue, allow the vendor or other customers to respond. Any post that looks like trolling / poaching will be removed.
  3. Discussion or promotion of DNN Platform product releases under a different brand name are strictly prohibited.
  4. No Flaming or Trolling.
  5. No Profanity, Racism, or Prejudice.
  6. Site Moderators have the final word on approving / removing a thread or post or comment.
  7. English language posting only, please.
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out