7

I have a site that is accessible both through http and https. I see the security review complains that base_url is not defined in settings.php.

However when I define it as http://example.com, and flush all caches, my template in https is not rendered.

When I comment out the $base_url line in settings.php everything comes back to normal.

How can I resolve this problem?

Improve this question
2
  • I was just going to ask this question. The problem is that most browsers will block insecure content when requesting over SSL. So if your base_url is example.com but you then access the site via example.com your browser will not load your theme files. The "Secure Pages" module, drupal.org/project/securepages I believe, lets you define a secure and non-secure base_url, though that module is currently in beta.
    – Screenack
    Jul 16, 2014 at 20:43
  • FYI, just tested securepages. It sets a secure and non-secure base_url, but the global base_url still holds for theme resources. So, no, not a solution.
    – Screenack
    Jul 16, 2014 at 20:53

4 Answers 4

Reset to default
5

You probably need to do something like this:

$protocol = (!empty($_SERVER['HTTPS'])) ? 'https' : 'http';
$base_url = $protocol . '://mysite.com';

...so that Drupal knows which protocol to use depending on how the site was accessed.

Improve this answer
3

I have had luck with:

$base_url = '//mysite.com';

Also, to maintain the session cookie, I usually add:

$conf['https'] = TRUE;

which allows for mixed mode.

Improve this answer
3
  • This answer is correct, it should be marked as such.
    – Rolando Isidoro
    Nov 10, 2015 at 17:41
  • This is answer is incorrect as it makes all url('path', array('absolute'=>TRUE)); be rendered as //mysite.com/path. You should use @colan's approach rather than this one.
    – zaporylie
    Oct 12, 2016 at 12:23
  • This answer may also break log-in on chrome. @colan's answer is the correct answer.
    – jenlampton
    Sep 6, 2017 at 23:10
2

This works well for me with several domains on the same Drupal install over CloudFlare:

if (isset($_SERVER['HTTP_X_FORWARDED_PROTO'])) {
  $base_url = $_SERVER["HTTP_X_FORWARDED_PROTO"] . '://' . $_SERVER['HTTP_HOST'];
} else {
  $base_url = 'http://' . $_SERVER['HTTP_HOST'];
}

Like this it also works well with CloudFlare flexible SSL. I can access the site both with and without SSL.

(It seems you don't need the Cloudflare module but it wouldn't hurt either to enable it.)

Improve this answer
2
  • If you're just going to use whatever host header was sent, I'm not sure setting the $base_url is even worth it at this point, because Drupal will automatically detect it if you don't specify it.
    – Brian
    Dec 19, 2016 at 19:22
  • Welkom (terug) in het land van 1K ... use the privileges that come with it wisely!
    – Pierre.Vriens
    Jul 13, 2017 at 15:58
0

Unfortunately the problem with setting the protocol relative to the accessed URL is that the site only references that when building the cached files and therefore creates all references to files and resources based on what protocol is used when rebuilding the site cache.

So, if you rebuild the cache from https, then all links are https. If you rebuild the site from http, then all links are http.

Rebuilding from https works best, but browsers may still block the secure content and may require users to manually allow the blocked content.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.