US NWS Change Breaks Forecast & Discussion Blocks - Easy Fix

[MonyMony]

Today, without warning the US National Weather Service implemented a change that basically requires all requests to use HTTPS. I was able to find this on the annoucement:

NOUS42 KWNO 271712
ADMNFD

SENIOR DUTY METEOROLOGIST NWS ADMINISTRATIVE MESSAGE
NWS NCEP CENTRAL OPERATIONS COLLEGE PARK MD
1712Z TUE FEB 27 2018


WEB SERVICE CHANGES FOR NCO STARTING AT 28/1500Z...


Removal of Weak Ciphers from NCEP Web Sites

As required by US Department of Homeland Security Binding
Operational Directive 18-01, NCEP/NCO will be making changes to
the underlying protocols that are used to access our public and
internal web sites. For web sites, the directive addresses
enforcement of secure HTTPS protocols for all access.


These changes will include:

Enabling HTTPS for sites that were previously HTTP-only

Redirecting HTTP traffic for all sites to the respective
HTTPS counterpart

Restricting HTTPS handshakes to Cipher suites that are known
to be secure.

Enabling a configuration that marks the affected sites for
HTTPS Strict Transport Security (HSTS)


The potential impacts that have been identified include:

Scripts that are attempting to connect to the HTTP service
that do not honor the redirect to HTTPS will fail.

Scripts or applications that do not support HTTPS protocols
will be unable to connect.

Browsers that do not support secure ciphers may be unable to
connect (we believe that this would only affect browsers that are
already obsolete, but that does not mean that they are not
possibly still in-use. Example: IE8 on Windows XP)

Users who have restrictive firewall rules at their side that
do not permit access to the HTTPS service may be unable to
connect.


Please be aware that all of the changes above are, in addition to
being mandated by DHS, considered a best practice in network
security and privacy. For more information on the transition to
HTTPS-only, please see https://https.cio.gov/

I have discovered that the following blocks are affected:

• areaForecastDiscussion

• nwsForecast

• nwsForecastCustom

(I will add I am not sure if the warningsUSRegions block is affected or not). UPDATE - warningsUSRegions is not affected!

The fix is easy for these blocks as you just need to change the reference for http: to https:.

• For areaForecastDiscussion search the file areaForecastDiscussionBlock.php and replace http: with https:

• For nwsForecast search nwsForecastBlock.php and replace http: with https:

• For nwsForecastCustom search customLoader.php and replace http: with https:

I'm sure Jachym will put a more formal update out for these soon but this is a quick way to get these blocks back up and working.

Enjoy!

[MonyMony]

Block usSPC also affected but the simple fix does not seem to work. Will investigate more later.

[gjstenbe]

Thanks a bunch for this! Quick and easy, indeed!

[MonyMony]

Block usSPC also affected but the simple fix does not seem to work. Will investigate more later.

Whatever issue was affecting the usSPC block and the http://www.spc.noaa.gov/ website seems to be fixed now and things are working normally with no alterations needed.

[dmgould]

US Radar block might be the same issue. I haven't had a chance to check into it yet.

[MonyMony]

US Radar block might be the same issue. I haven't had a chance to check into it yet.

Looks like they managed to break their own site. All the radars look to be down now and I have to think it is related.

https://radar.weather.gov/radar.php?rid ... 11&loop=no

Screen Shot 2018-02-27 at 8.34.05 PM.png (305.6 KiB) Viewed 25110 times

I am curious if the radars go HTTPS too.

[Jeffm5690]

Thanks for the catch and quick fix. You’re right about the radars.... seems like they are all out...

[dmgould]

They are back up working for now. I pulled the whole US animated gif URL (http) from the block code and pasted it into my browser. It went to the blank map but showing no radar returns. When I changed it to https I got the radar returns. Now when I put in http is forwards automatically to https and shows the radar returns. Eventually I'm thinking all of the http URLs in the radar block will have to be changed to https as well. At least they made it work for now.

[dmgould]

So I can confirm that changing http to https in the US radar block for the local radars works. In other words it works now using either http or https, so no doubt they are in the process of changing it over. However, it does not work for the block showing the entire US using https except for the "Doppler" selection. All is working in the block at this point without making any changes, but I suspect that may change shortly. At least we know what to do if it does.

[Jachym]

OK I guess if https works we can replace it with https, I will do it as soon as possible, but it might not be before the weekend, Im on a business trip Thu and Fri

[MonyMony]

Eventually I'm thinking all of the http URLs in the radar block will have to be changed to https as well. At least they made it work for now.

I completely agree with you. I was doing some reading on this quick change and there is some speculation there was a hack last week which prompted this quick cut-over. I expect all of the remaining NWS sites, including the radars, to also change soon.

[Jeffm5690]

Well if the change is for a reason like that it’s ok. They are just notorious for making changes and I know it gets frustrating. Especially for our coder “god”

[WyoDog]

MonyMony good detective work. Thanks for the fix.

[BobW55]

MonyMony,
You are the man.
I just notice this on my pages this morning.
I was digging into it, and came here to ask about it an low and behold you found the issue and the fix.
Did not appear to affect my radar only my NWS Forecast Custom block.

Thanks again.

[stefanbagnato]

I just tried this for both the forecast discussion as well as nws forecast blocks, but it did not work for either. Has anyone else had the issue? It is not cache related.
southwakeweather.com

[Jeffm5690]

Strange. I have not had a problem since the update.

[dmgould]

I just tried this for both the forecast discussion as well as nws forecast blocks, but it did not work for either. Has anyone else had the issue? It is not cache related.

The fix is working still fine on both of my sites today. It might just be that NWS is still playing with things. I think they are still in transition on some of the changeover.

[MonyMony]

I just tried this for both the forecast discussion as well as nws forecast blocks, but it did not work for either. Has anyone else had the issue? It is not cache related.
southwakeweather.com

Strange indeed!

As others have stated, things have been working well for me too since the update. I have attached the files I updated which should do the trick. If that doesn't work I'm not sure what else to suggest.

Note: My version of the Discussion has a customization to create separate paragraphs which is included in the attached file. Philadelphia/Mount Holly NWS can write some very long discussions and it was too hard to read without the breaks. Been using this change for over a year and it works great. Look at my page to see it in action if you are interested.

Hope this helps!

[stefanbagnato]

Thank you for that. I tried it, but for some reason, it still does not work. Doesn't make much sense, but I will just let it be for now. When Jachym has a moment to look at the main issue, I know he will push out a fix for all of the affected blocks. If NWS would stop making changes, we wouldn't be having this issue!

[Jachym]

I will look at the NWS blocks next weekend

[Ken Good]

Since they made the change, the South Texas radars on the National Map have been showing a lot of ground return. They need to make a few more adjustments.