Repository navigation
Change base URLs for NCBI services to use https instead of http #522
Description
To improve end user security and privacy, and by Federal government mandate OMB memo M-08-023, NCBI will be moving all web services to HTTPS-only on or before December 31, 2016.
Looking over the biojava source code, I notice that the eutilities base URL starts with http://
https://github.com/biojava/biojava/blob/master/biojava-core/src/main/java/org/biojava/nbio/core/sequence/loader/GenbankProxySequenceReader.java#L59
It needs to be updated to use https:// URLs instead. While we intend to provide redirects for GET and HEAD, POST and other non-safe methods will likely not be redirected; in particular, epost will cease to function over http when we move to https.
For more information:
- http://www.ncbi.nlm.nih.gov/news/06-10-2016-ncbi-https/
- https://https.cio.gov/
- subscribe to the utilities-announce mailing list at https://www.ncbi.nlm.nih.gov/mailman/listinfo/utilities-announce
Activity
heuermh commentedon Jun 28, 2016
Thank you, @elucify!
I just fixed this in biojava-legacy (biojava/biojava-legacy#34) and intend to make a pull request here shortly.
heuermh commentedon Jun 28, 2016
Closing as duplicate of #505
elucify commentedon Jun 28, 2016
Great! What is the difference between biojava and biojava-legacy? What version of biojava (and/or biojava-legacy) should we tell users of your library to upgrade to, to get the fix?
Thanks
andreasprlic commentedon Jun 28, 2016
we'll pull a quick release once we have a commit. that means it will be either in biojava 4.2.4 or the upcoming biojava 5 series.
heuermh commentedon Jun 28, 2016
https://github.com/biojava/biojava-legacy is the 1.x series of releases, before major refactorings that led to biojava2 (never saw the light of day), biojava3 (no longer active), and currently biojava 4.x in release branches and work towards 5.0 on git master.
The next biojava-legacy release will be 1.9.3 and the next biojava release will be 4.2.4.
heuermh commentedon Jun 28, 2016
yeah what @andreasprlic said :)
elucify commentedon Jun 30, 2016
Do you have some idea when those releases will be generally available? I'd like to tell users of biojava (via the NCBI website) the minimum release numbers for the 1.x and 4.x branches, so that their code works correctly after NCBI shifts to https.
josemduarte commentedon Jun 30, 2016
There's not many constraints for making a 4.2.x bugfix release. We can produce one as soon as we think some important patches have been contributed. So 4.2.4 will surely contain these patches. We can set a date for it, say end of July.
Merge pull request #526 from andreasprlic/bugfixes-4.2
josemduarte commentedon Jul 29, 2016
@elucify we've got a fresh bug fix release out today with the updated NCBI URLs: https://github.com/biojava/biojava/releases/tag/biojava-4.2.4