"HTTPS Redirect" And Private Blogs

URL redirection is a Blogger magic trick, similar to a common sleight of hand trick in stage magic performances.

The Blogger HTTPS Redirection, a recently added feature in Blogger security, may be a similar Blogger magic trick - and a possible problem. Some browsers treat websites with multiple redirects as possibly malicious.

Private blogs, accessed through the Blogger / Google interstitial login, may also complicate HTTPS Redirection.

Interstitial webpages may pop up like magic, where you (or your prospective viewer) would least expect them.

• In front of a "private" blog, where you have to identify yourself to continue.
• In front of a blog that contains (or is reputed to contain) objectionable material (naughty pictures or such).
• In front of a blog that is (or appears to be) published off site.
• In front of a blog that has been blocked, for TOS violation, or maybe for hosting hacking content.

One of the problems with HTTPS Redirection may involve private blogs.

To access a private blog, you must be identified.

To access a private blog, one must be logged into Blogger, using an account that is a member or owner of the blog.

If you are not logged in to Blogger, you may be asked to identify yourself, to access the blog.

If you are logged in to Blogger, but using a non member / owner account to access the blog, you may simply be refused access.



Both of those displays come after the link to the blog - and before the blog is viewed. They are called "interstitial" webpages.

If you try to access a private blog, and are not a member / owner, you should see the well known Blogger / Google interstitial login webpage. In order to check that you are a member / owner, the infamous Google Login Cookie must be accessed.

The Google Login Cookie, created under the Google login sequence and accessed from a Blogger display, is a "third party" cookie. If the browser blocks "third party" cookies, as many do, the browser may refuse access to the private blog - even if the prospective reader is logged in to Blogger, as a member or owner.

If third party cookies are not blocked, too many redirects may present a problem.

If third party cookies are not blocked, some browsers may still have a problem - too many redirects. Some browsers may object to multiple redirects to other websites - as possible malicious content. A redirect to an interstitial display, following the "HTTP to HTTPS" redirect, may be one too many redirects.

The mysterious Blogger "private blog" interstitial display, which lets people login to a private blog when necessary, may contribute to the "too many redirects" problem, for browsers which are sensitive to multiple redirects. Even if a private blog member / owner is logged in properly, the interstitial display is still involved, in checking for proper login - and this is where the infamous "third party" cookie is involved.

You may need to adjust your security settings, for best results.

If you are trying to access a private blog - and you see "This blog is open to invited readers only", or you are forced to login, again (!!), you will need to check and correct your cookie filters. You might want to similarly check and correct your script filters.

Please remember that the filter that is affecting your private blog access - whether cookie or script - may not be part of your browser native settings. Check thoroughly.

---

One of the challenges involved with the recently added #Blogger "HTTPS Redirect" may involve private blogs, and the Blogger private blog interstitial login. "Third party cookie" filters, and the Blogger private blog interstitial login, will complicate this problem.

https://productforums.google.com/d/topic/blogger/WiR84_IRF8w/discussion

Custom Domain Publishing And Private Blogs

We see an occasional report in Blogger Help Forum: Get Help with an Issue, about custom domain publishing.

My readers can't view the blog - they get a redirection count error!

DNS analysis shows a properly setup domain. When we try to examine the blog, we see a private blog notice - or we are required to login.

But why a private blog, using a custom domain?

The purpose of publishing to a custom domain is to increase readership - by making a blog more visible, using a non BlogSpot URL.

A private blog has limited readership, based on permissions provided by the owner. The need to make a blog private conflicts with the need to increase reader population.

Besides the functional conflict, there's a second problem with combining a custom domain published blog, and access by invitation. Both the custom domain redirection, and the private blog redirection involve interstitial code.

This is a private blog. Combine this, and a custom domain redirection - and you get trouble.



A potential blog reader, when accessing the blog by the BlogSpot URL, will redirect to the domain URL - and then to the access checking interstitial. Some browsers will interpret this as a possible security issue, and cite

Too many redirections!

In other cases, the two redirections may lead to a redirect loop - and the reader will see a white screen of death.

What ever the result - "Too many redirections", or a redirect loop, the potential reader will never see the blog.

If you want to publish a blog, and limit reader access by invitation, you're better off publishing to BlogSpot. If you want to use a non BlogSpot URL, a public blog makes sense.

---

You are allowed to publish a #Blogger blog with a designated reader population - and you're allowed to publish a blog to a non BlogSPot URL.

You can publish a private blog to a custom domain, if you wish - but this is not recommended. Learn why combining limited access with a non BlogSpot URL is not a good idea.

https://productforums.google.com/forum/#!category-topic/blogger/5IUByvxKYeg