7
Yes, the cookies are still susceptible to being intercepted. The full set of cookies for matching domains is transmitted by the browser with each page request to that domain, even if the original cookies were set using HTTPS/SSL and the current page is HTTP.
One way around this is by setting the "secure" flag on cookies you set. Any cookies set with the "...
4
It turns out this error was caused by a misconfiguration of the SSL certificate at the web host's end.
After getting the error on Exp:resso Store pages using https, I tested a page load of the home page (a non Store page) and got the same error. I concluded it wasn't an Exp:resso Store specific issue.
I eliminated htaccess as the source of the error by ...
4
This is always a themes folder and protocol issue, I've found. You mentioned this:
$env_config['cp_url'] = $env_config['base_url'] . '/admin.php';
What are you parameters for various $env_config array entries? Make sure that array is using https for that URL, and also your themes folder must also be behind SSL.
Update
Hey, so are you forcing SSL for all ...
2
It's also worth noting that using protocol relative ( //domain.com ) will work in most situations. This allows you to not have to hardcode a protocol specific url. Helpful when you're using the same code on a live HTTPS site as well as a local, HTTP site.
2
Just make sure your site url and all of your url paths in your admin > general configuration are https:// and also go to your content > file > file upload preferences and make sure that the url path there is https://. Also if you are hard coding the urls in your html head when attaching assets like css and js make sure those are https:// as well.
2
Firstly I think you should rename admin.php to something else, in line with the Post-Installation Best Practices which can be read at http://ellislab.com/expressionengine/user-guide/installation/best_practices.html
I would go for a sub-folder, and rename it something obscure like /badgers/index.php
In turn, this would make your htaccess file easier because ...
2
First thing to ask is, do you really need to? Your links could just be protocol relative:
{stash:item_link}//example.com{/stash:item_link}
If that's not the issue then you could create a global prefix in your config using Stash's config variable stash_var_prefix:
$config['stash_var_prefix'] = isset($_SERVER['HTTPS'] ) ? 'ssl:' : 'nonssl:';
(Note that a ...
2
This was a silly oversight after a long week of coding. Upon login the website redirected with a prefix of "www" where the rest of the site does not use this.
Fixed with WWW resolve in .htaccess
2
Just remove the protocol from the Default base URL in system settings > URL and Path Settings, so you have:
//yourdomain.com/
instead of
http://yourdomain.com/
2
You'll need to access your templates fix this issue. Log in to your control panel, and visit:
Design -> Templates -> Template Manager
Most likely, you'll have a template group named "Embeds", "Includes", "Global", "Layouts", or something along those lines. In that template group you will likely have a template named "head" or "header". What we are ...
1
Looks like I needed to clear the ce cache directory and it's working now.
1
this worked for me:
Options -Indexes
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
# Removes index.php from ExpressionEngine URLs
RewriteCond %{THE_REQUEST} ^GET.*index\.php [NC]
RewriteCond %{REQUEST_URI} !/YOURSYSTEMFOLDER/.* [NC]
RewriteRule (.*?)index\.php/*(.*) /$1$2 [R=301,NE,L]
...
1
check your theme folder url. most likely that is set to http
1
Great write up by Jesse Knowles - took me 10 minutes to be up-and-running with https. http://www.jesseknowles.com/blog/article/forcing-https-on-an-expressionengine-site/
1
My general steps are:
Set up General Configuration > URL to the root directory of your site to use https.
Set up File Upload Preferences > > URL of Upload Directory to use https. This makes sure your images/documents are properly linked.
To catch any other http references:
View source of your web page and search "http:".
Search for "http:" in your file ...
1
The issue is that your CP and themes folder are not set to run https.
Make sure your cp url and themes folder are set to run https://
You'll possibly run into the same thing with any "ACT=" urls if the protocols don't match.
1
From what I understand, CartThrob's Authorize.net gateway plugin uses curl to communicate with Authorize.net. What kind of SSL connection curl uses depends on your server's configuration, not CartThrob.
To test wether your server has SSL 3 enabled, you can use Qualys' SSL Server Test: https://www.ssllabs.com/ssltest/
This is also an excellent article about ...
1
I might be missing something here, but in your Control Panel > Administration > General Configuration page, just set the URL to the root directory of your site setting to:
//www.mysite.com/
(replacing that with your site URL)
Same for the URL to your "themes" folder setting.
Using the double-slash with no http prefix means that it is protocol ...
1
Without knowing the details of your install and project, this questions is pretty impossible to answer in my opinion.
First make sure you change $config['site_url'] = "http://domain.com/"; to $config['site_url'] = "/"; in your config file.
$config['site_url'] = "//domain.com/"; may work also.
If that doesn't do it, you'll need to identify the exact ...
1
Okay pinned this one down, it made no sense for good reason.
We were running the staging site out of the same hosting account as the live site, which should have been fine. But due to a misconfiguration, any SSL pages were being loaded from the live site but as we load the DB based on the hostname, it was still pulling the stage DB.
As only some pages ...
1
Ended up solving this with a combo of Switchee and Stash:
{exp:switchee variable="stash:secure" parse="inward"}
{case value="y"}
{exp:dm_force_ssl:force}
{/case}
{case value=""}
{exp:dm_force_ssl:unforce}
{/case}
{/exp:switchee}
Since Stash was used to set the "secure" variable, and Switchee is Stash-aware, you can ...
Only top voted, non community-wiki answers of a minimum length are eligible