Search…

X3 Photo Gallery Support Forums

Search…
 
pede
Experienced
Topic Author
Posts: 70
Joined: 08 Apr 2019, 06:03

Is the built-in X3 password prompt insecure?

21 Oct 2026, 05:22

Hello!

I use X3 for our private family photos. I’ve set up X3 so that a username and password are required to access it.
I’ve noticed that when I open the page (in MS Edge or Vivaldi), the password prompt window appears. That’s normal. But in the address bar at the top, there’s a message saying the page is insecure:
http-https.png
http-https.png (73.48 KiB) Viewed 69 times
But it is an HTTPS page, and the certificate is valid. The warning only disappears after I enter my username and password.
Is entering the password actually unsafe? Did I configure something incorrectly, or is there another explanation for this behavior?

Thank you very much for X3 and your support!
 
User avatar
mjau-mjau
X3 Wizard
Posts: 14509
Joined: 30 Sep 2006, 03:37

Re: Is the built-in X3 password prompt insecure?

23 Oct 2026, 00:43

What is the link? You can send by email or in PM. I can't see anything like that on our own website (also X3).
https://www.photo.gallery/

Could be you are using a self-signed SSL or something else ...
 
pede
Experienced
Topic Author
Posts: 70
Joined: 08 Apr 2019, 06:03

Re: Is the built-in X3 password prompt insecure?

25 Oct 2026, 05:12

Since the certificate is valid after a second check, I continued to look for the cause.
Finally, I discovered that the “index/” directory was specified under the “Protect” menu item. After I changed this to *GLOBAL instead /index, https:// now works fine starting from the login window.
Attachments
wrong.png
wrong.png (39.94 KiB) Viewed 15 times
ok.png
ok.png (34.94 KiB) Viewed 15 times
 
User avatar
mjau-mjau
X3 Wizard
Posts: 14509
Joined: 30 Sep 2006, 03:37

Re: Is the built-in X3 password prompt insecure?

25 Oct 2026, 11:08

Ok, good, although I'm not quite sure what your browser is reporting. Your website is either SSL or not (and it is). It could be the browser is detecting that you are logged in (cookie), but that the index page does not require login (which would be correct). This is of course harmless, since it's supposed to be like that when you don't assign login to the index.