Using the login_form tag, is there a way to specify a secure return address, without entering a full domain name? Only the 'intranet' part of the site should be under https.

For example, I can do this:

{exp:member:login_form return="https://www.mywebsite.com/intranet/"}

But I can't do something like this:

{exp:member:login_form return="intranet/index" secure="yes"}

With the first method, it seems a bit naff how you see a 'You are now logged in' page that's http rather than https after logging in. Also, using a full domain name doesn't play nicely with version control and multi-server environments.

1 Answer 1


Is your login form page https? Seems like return="" would keep you on the same protocol with a relative path if your originating form was over https.

You could use a redirect as I described in this thread regarding requiring SSL which would also prevent users from accidentally ending up on http:// as well. Though it'd be unfortunate if you had to do a redirect and I wonder if it opens you up to some sort of session hijacking.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.