Secure Login not Working

Question

I'm running drupal 7 with the secure login module and login toboggan. After installing it, going to http://site.com I see the usual site, with the login button.

The login form action has not changed, it remains a POST to /node?destination=node. Sure enough, if I login there my password is sent in the clear with a POST to http://site.com/node?destination=node

Any ideas on how I might start debugging this? The securelogin.module seems really straightforward, just some hooks. Is there a logging statement I can add there to see if these hooks are being called?

update I also noticed this other problem (probably the same cause).

Sometimes when I start a fresh browser and go to http://site.com I get 302's to https://site.com automatically. If I then log in the POST goes over https (good!) but I then get 302'd back to http://site.com, where I appear NOT logged in. If I just change the URL to https://site.com I can see that I am indeed logged in.

I am very confused.

Answer 1

To force SSL for login, admin, node editing etc, I use http://drupal.org/project/securepages - also has has configuration options to force plain HTTP when browsing the site as well (which can save you load).

Answer 2

Ok, the problem seems to have been that I had $base_url = 'http://site.com' set in my settings.php.

This resulted in that, after a successful login on https, the user got 302'd back to an http: page which showed him as not logged in. By commenting out the base_url the re-direct now sends the user back to an https and shows him logged in. So, it all seems to work.