Secure Login Forms

Question

At present there doesn't seem to be an easy way to login securely using the Member module. Safecraker provides useful parameters in secure_action="yes" and secure_return="yes" to ensure encrypted submissions but the login form is left wide open by default (which is a unbelievable!).

How do other people handle secure login form submissions to ensure they are posted over HTTPS in the lack of a built in facility by default in EE?

I know that FreeMember has recently has this support added but if I'm not using FreeMember than I'd like to be able to find a way to secure my logins.

UPDATE: It looks like Zoo Visitor also supports secure login forms and it's now just been added to the docs with the same parameters as Safecracker.

Answer 1

In my case I think this solution works best. Using a combination of DM Force SSL to ensure that that template is served over HTTPS, and Find and Replace Plus to swap out 'http' with 'https'. They can be used in combination with the default Login form to provide a secure login:

{!-- Load the page over SSL --}
{exp:dm_force_ssl:force}

{!-- Ensure the form submits over HTTPS --}
{exp:replace_plus find='action="http:' replace='action="https:'}
    {exp:member:login_form id="login_form"}

        Login form...

    {/exp:member:login_form}
{/exp:replace_plus}

I've also submitted a feature request to EllisLab to try and get secure_action="yes" and secure_return="yes" included in the default Member module login form.

FreeMember and Zoo Visitor provide ready-made alternatives if using those modules and Authenticate goes some way towards providing some security too but I'm not sure it's fully encrypted...(?) Thanks Tyssen.

Answer 2

Authenticate has a secure_return parameter. Will that do the trick?