I'm trying to secure a form submission, but can't get it to work. I have SSL installed, I have the csrf_protection enabled on my ExpressionEngine config file, and have secure_action and secure_return set to yes in my exp:free:composer tag. Not sure what else I'm supposed to do. If I go directly to the form page and add https://, it works. But when there's any other link to that page from my site, it goes to the non-secure version. My understanding is that the secure form would load if I added the secure_action variable in the tag. Is this the wrong way?
1 Answer
secure_action="" and secure_return="" do not force, or redirect, the form's URL to be HTTPS. These parameters set the URL protocol for after the form is submitted.
The secure_action="" parameter will make your form's action="" attribute use https, eg: https://mysite.com/index.php?ACT=123
The secure_return="" parameter will return you to a URL using https after submitting the form. For example with secure_action="yes" and return="contact/thank_you", Freeform will send you to https://mysite.com/contact/thank_you after submitting the form.
The actual form page can be http or https, depending on the URL you visit. Freeform is not involved at that point. You would need to use .htaccess to force https pages on your site, or set up EE's config.php file to make all links https when you're visiting an https version of the site. For the config.php settings, this would still not prevent a user from visiting an http URL though.
