Previously I have posted entries about using SSL with Windows Live Writer.  If you haven’t read my previous entries (here, here, and here) about how your password is being sent over the Internet in clear-text then I would recommend you follow my links and have a quick read.

I was very excited to see my suggested changes make it into BlogEngine.NET 1.4.5 and was anxious to get up to the latest version and take advantage of the new functionality.  I quickly discovered a problem though when I included a file attachment and/or an image in my entries.  Both files and images were using the HTTPS connection string instead of the http string.  While not a serious issue it was a nuisance for users who didn’t want to use SSL to download the images and files. 

Added to the pain is that I am using a free Startcom SSL Certificate for my website and the root certificate authority isn’t included in everyone’s browser.  So you would see an ugly certificate warning when you tried to read a post with an image and/or file attachment.

I thought I remembered this issue before so I went trolling through my previous blog entries.  I had provided a suggested patch to the BlogEngine core that would handle this issue.  The problem was that a change to the BlogEngine core after v1.4 broke the suggested patch.  So here we are again with an old issue back again.

I went through the BlogEngine core files and found the problem.  An improvement to the AbsoluteWebRoot method provides for a fresh value each time it’s called upon.  In previous versions the AbsoluteWebRoot was loaded at startup and cached in memory.  So my previously suggested fix was to use the cached path which always returned http instead of the https that is used by the MetaWeblogHandler method.  Now I can’t use the AbsoluteWebRoot for the http value since it returns https.

About the only thing that came to mind was to adjust the MetaWeblogHandler.cs file in the BlogEngine core files to look and see if the “Require SSL for MetaWeblog API” option was enabled and then replace the https for http during the image and file url building method.  Specifically, found on line 331 of the MetaWeblogHandler.cs file you will find the following syntax:

string rootUrl = Utils.AbsoluteWebRoot.ToString();

But to correct the issue the MetaWeblogHandler.cs file needs to be updated to include the following syntax:

string rootUrl = Utils.AbsoluteWebRoot.ToString();
if (BlogSettings.Instance.RequireSSLMetaWeblogAPI)
  rootUrl = rootUrl.Replace("https://", "http://");

As you can see the result will be that your image and file url’s will be http instead of https.  I submitted this to the BlogEngine Issue Tracker and we will see if Mads will include it in a future build.

Unfortunately for those not willing to recompile their core DLL file you will need to wait until the patch is applied and released for download.  If you would rather not wait that long then you can drop me a note and I will compile an updated core DLL file for you.