I have found inconsistent ssl behavior throughout the xp-dev site while I am administering my projects. First, using wiki page navigation (for xp-dev project management, not trac) creates links that start with “http” regardless of whether I am connected securely or not. My current work-around is just creating https links instead. The second problem is when I click on “Edit” when attempting to edit comments on the wiki (for xp-dev project management, not Trac). In Google Chrome, mousing-over the “Edit” link shows it starts with “http” whereas IE8 displays a prefix of “https” in the link. However, they both navigate to an unsecured edit page.

I have not checked everywhere on the site to see if this security issue goes beyond the issues I have described. However, this can be a real problem because once a person leaves https, navigation continues to be unsecured until they consciously navigate to a known secure page or modifies the address in their browser.