Using login_form tag with https

Question

Using the login_form tag, is there a way to specify a secure return address, without entering a full domain name? Only the 'intranet' part of the site should be under https.

For example, I can do this:

{exp:member:login_form return="https://www.mywebsite.com/intranet/"}

But I can't do something like this:

{exp:member:login_form return="intranet/index" secure="yes"}

With the first method, it seems a bit naff how you see a 'You are now logged in' page that's http rather than https after logging in. Also, using a full domain name doesn't play nicely with version control and multi-server environments.

Answer 1

Is your login form page https? Seems like return="" would keep you on the same protocol with a relative path if your originating form was over https.

You could use a redirect as I described in this thread regarding requiring SSL which would also prevent users from accidentally ending up on http:// as well. Though it'd be unfortunate if you had to do a redirect and I wonder if it opens you up to some sort of session hijacking.