Page works with SSL, but not internally

Question

I struggled a long time with Drupal in order to get my page to load with SSL. I ended up getting it to work my modifying settings.php:

/**
 * Base URL (optional).
 *
 * If Drupal is generating incorrect URLs on your site, which could
 * be in HTML headers (links to CSS and JS files) or visible links on pages
 * (such as in menus), uncomment the Base URL statement below (remove the
 * leading hash sign) and fill in the absolute URL to your Drupal installation.
 *
 * You might also want to force users to use a given domain.
 * See the .htaccess file for more information.
 *
 * Examples:
 *   $base_url = 'http://www.example.com';
 *   $base_url = 'http://www.example.com:8888';
 *   $base_url = 'http://www.example.com/drupal';
 *   $base_url = 'https://www.example.com:8888/drupal';
 *
 * It is not allowed to have a trailing slash; Drupal will add it
 * for you.
 */
 $base_url = 'https://www. ... .com';  // NO trailing slash!

But now I am faced with an entirely new issue, one related to the changes I made in setting.php.

Now, when I try to reach my page internally by 192.168.1.x/?q=user, I get a terribly messed up login page, and after entering my login information, I get redirected to a page that shows nothing but "SSL connection error".

What have I done!? Will this ever work?

Answer 1

Try this:

$base_protocol = empty($_SERVER['HTTPS']) || strtolower($_SERVER['HTTPS']) != 'on' ? 'http' : 'https';
$base_url = $base_protocol . '://www.mysite.com';

Though you may need the Secure Pages module for it to work, or to have redirection set up in your .htaccess file or virtualhost.

Answer 2

So, I have to give props to @Darvanen for pointing me in the right direction, but my answer was a little more complex.

Because you can never guarantee what will be a part of the $_SERVER array, I have done a check against many different indexes of the array:

    if((!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off')
|| (!empty($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https')
|| (!empty($_SERVER['HTTP_CF_VISITOR']) && strpos($_SERVER['HTTP_CF_VISITOR'], 'https') !== false)
|| $_SERVER['SERVER_PORT'] == 443)
{
    if(!empty($_SERVER['HTTP_HOST']))
    {
        $base_url = 'https://'.$_SERVER['HTTP_HOST'];
    }
    else
    {
        $base_url = 'https://www.example.com';
    }

    error_log("base_url set: ".$base_url, 0);
    error_log(print_r($_SERVER, true), 0);
}
else
{
    if(!empty($_SERVER['HTTP_HOST']))
    {
        $base_url = 'http://'.$_SERVER['HTTP_HOST'];
    }
    else
    {
        $base_url = 'http://www.example.com';
    }
    error_log("base_url set: ".$base_url, 0);
    error_log(print_r($_SERVER, true), 0);
}

I've tested this logic over and over again, and, so far, it appears to work in every case.

If you are wondering why I used:

$base_url = 'https://'.$_SERVER['HTTP_HOST'];

and

$base_url = 'http://'.$_SERVER['HTTP_HOST'];

it is because I have multiple domain-names redirecting to the "same-page".

Doing this allows the user to keep the same domain name that they entered the site with.