I have a site that is accessible both through http and https. I see the security review complains that base_url is not defined in settings.php.

However when I define it as http://example.com, and flush all caches, my template in https is not rendered.

When I comment out the $base_url line in settings.php everything comes back to normal.

How can I resolve this problem?

  • I was just going to ask this question. The problem is that most browsers will block insecure content when requesting over SSL. So if your base_url is example.com but you then access the site via example.com your browser will not load your theme files. The "Secure Pages" module, drupal.org/project/securepages I believe, lets you define a secure and non-secure base_url, though that module is currently in beta. – Screenack Jul 16 '14 at 20:43
  • FYI, just tested securepages. It sets a secure and non-secure base_url, but the global base_url still holds for theme resources. So, no, not a solution. – Screenack Jul 16 '14 at 20:53

You probably need to do something like this:

$protocol = (!empty($_SERVER['HTTPS'])) ? 'https' : 'http';
$base_url = $protocol . '://mysite.com';

...so that Drupal knows which protocol to use depending on how the site was accessed.

| improve this answer | |

I have had luck with:

$base_url = '//mysite.com';  

Also, to maintain the session cookie, I usually add:

$conf['https'] = TRUE;

which allows for mixed mode.

| improve this answer | |
  • This answer is correct, it should be marked as such. – Rolando Isidoro Nov 10 '15 at 17:41
  • This is answer is incorrect as it makes all url('path', array('absolute'=>TRUE)); be rendered as //mysite.com/path. You should use @colan's approach rather than this one. – zaporylie Oct 12 '16 at 12:23
  • This answer may also break log-in on chrome. @colan's answer is the correct answer. – jenlampton Sep 6 '17 at 23:10

This works well for me with several domains on the same Drupal install over CloudFlare:

  $base_url = $_SERVER["HTTP_X_FORWARDED_PROTO"] . '://' . $_SERVER['HTTP_HOST'];
} else {
  $base_url = 'http://' . $_SERVER['HTTP_HOST'];

Like this it also works well with CloudFlare flexible SSL. I can access the site both with and without SSL.

(It seems you don't need the Cloudflare module but it wouldn't hurt either to enable it.)

| improve this answer | |
  • If you're just going to use whatever host header was sent, I'm not sure setting the $base_url is even worth it at this point, because Drupal will automatically detect it if you don't specify it. – Brian Dec 19 '16 at 19:22
  • Welkom (terug) in het land van 1K ... use the privileges that come with it wisely! – Pierre.Vriens Jul 13 '17 at 15:58

Unfortunately the problem with setting the protocol relative to the accessed URL is that the site only references that when building the cached files and therefore creates all references to files and resources based on what protocol is used when rebuilding the site cache.

So, if you rebuild the cache from https, then all links are https. If you rebuild the site from http, then all links are http.

Rebuilding from https works best, but browsers may still block the secure content and may require users to manually allow the blocked content.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.