Insecure content warning with D7 and SSL

Question

I'm running Drupal 7 with Drupal Commerce module. I have SSL enabled on my server. I've confirmed that the SSL is properly enabled (If I replace Drupal's index.php with a simple index.html, Chrome allows me to browse to my domain via https).

I'm getting a bunch of error messages like this:

The page at https://example.com/ ran insecure content from http://www.example.com/sites/default/files/css/css_TsVRTbLFUpEZAfw-_bWPJu840QT523CPjUVJ5MRWfyk.css

There are about 20-30 of these errors - mostly .js and .css files, some .png etc. Questions:

1. How can I configure d7 so that it accesses these files via relative paths

2. Are there any other workarounds here, to enable https on my drupal install?

Much thanks in advance.

Answer 1

Somewhat ugly, but you can do something like this for Drupal 6

function mytheme_preprocess_page (&$vars)
{
  $vars['scripts'] = str_replace("http://www.example.com/", "/", $vars['scripts']);
  $vars['styles'] = str_replace("http://www.example.com/", "/", $vars['styles']);
  $vars['content'] = str_replace("http://www.example.com/", "/", $vars['content']);
}

or for Drupal 7

function mytheme_process_html (&$variables) {
  $variables['scripts'] = str_replace("http://www.example.com/", "/", $variables['scripts']);
  $variables['styles'] = str_replace("http://www.example.com/", "/", $variables['styles']);
  $variables['page'] = str_replace("http://www.example.com/", "/", $variables['page']);
}

You can be a bit smarter and use PREG, but have never run into the need. Note that there may be a few additional regions / variables that you need to do replacement on.

I normally put in something similar to handle hardcoded URLs from the WYSIWYG when migrating from a dev URL to a live one.

Answer 2

Simply remove $base_url from your settings.php file; Drupal will detect $base_url automatically.

If you must set this value explicitly, you can add a little conditional logic to your settings file, such as:

if (isset($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) == 'on') {
  $base_url = 'https://example.com';
}
else {
  $base_url = 'http://example.com';
}

Answer 3

I had the same issue. In my case the pre-processing worked fine. However, when the requests were coming in from our Load Balancer, the pre-processing was not working. Strange.

Even so, found an easier solution. Add - $base_url = ''; to the settings.php

This way both http and https requests work fine. All css calls, etc. constructed by Drupal become relative and start with "/sites/..." instead of "http://servername/sites/..."

IMHO the default, if no base_url is specified should be relative URLs and not absolute. May be a fix in the next version of Drupal?

Answer 4

In setting.php file of drupal 7/6 add the following:

if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && 
$_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https') {
  $_SERVER['HTTPS']='on';
}
else {
  $_SERVER['HTTPS']='';
}

Answer 5

If your website runs behind the reverse proxy (such as CloudFront), enable reverse_proxy setting.

Drupal 8

Apply the following settings in site's settings.php file:

$settings['reverse_proxy'] = TRUE;
$settings['reverse_proxy_addresses'] = [@$_SERVER['REMOTE_ADDR']]

It should work for CDN where IP addresses are dynamic.

This is explained in the following comment:

 * In order for this setting to be used you must specify every possible
 * reverse proxy IP address in $settings['reverse_proxy_addresses'].
 * If a complete list of reverse proxies is not available in your
 * environment (for example, if you use a CDN) you may set the
 * $_SERVER['REMOTE_ADDR'] variable directly in settings.php.
 * Be aware, however, that it is likely that this would allow IP
 * address spoofing unless more advanced precautions are taken

Drupal 7

$conf['reverse_proxy'] = TRUE;
$conf['reverse_proxy_addresses'] = [@$_SERVER['REMOTE_ADDR']];

---

Related: Setting reverse_proxy and reverse_proxy_addresses behind AWS ELBs.

Answer 6

In your settings.php file, you can add the following line:

$base_url = 'https://www.yourdomain.com';

Answer 7

$base_url=''; worked for me, but note that bootstrap will puke on it, and needs the following change:

/var/www/includes/bootstrap.inc

if (isset($base_url)) { 

//change to (should be this way anyway?):

if (isset($base_url) && $base_url!='') {