-
Notifications
You must be signed in to change notification settings - Fork 1
Description
It seems like UCSB Wireless Web is starting to use https://login2.wireless.ucsb.edu/login.html instead of login.wireless.ucsb.edu
This has always been an issue, but it was much less prevalent. The fix would be to actually find out where we are redirected when we do the captive portal test. If it matches "^https://login[0-9]_.wireless.ucsb.edu/login.html[.]_$", then we send the login message to that redirected message.
The issue is that we could theoretically be sending the login information to some false host. However, if we are redirected to that page and the secure channel connects, then it should be the proper page hosted by UCSB. Therefore, there will be no issue with man-in-the-middle attacks.
This change will only allow us to support the login2.wireless.ucsb.edu url connection, as well as future proofing possible login3 and login99 pages. I don't know why these new pages are popping up but there are a lot this quarter, specifically in Davidson Library and Harold Frank Hall.
For some reason, this does not affect login.wireless.ucsb.edu/logout.html. That page remains consistent. Only the log-in page changed.