4

Environment: apache + ssl + domain access

Our drupal 7 site uses domain access multiple sub domains our server is SSL enabled

if I do not set $base_url in settings.php then all of our assets our loaded via HTTP and the user receives a mixed content error

If I DO set $base_url users are redirected to the default subdomain (e.g. foo.blah.com) instead of their current domain (e.g. bar.blah.com)

My question is, how do I force drupal to load all assets via HTTPS?

That way I can uncomment the #base_url

| improve this question | |
5

I updated settings.php with: $base_url = 'https://'.$_SERVER['SERVER_NAME'];

| improve this answer | |
  • 2
    This is a great way to ensure all resources are requested over https if you are using the domain access module. In a project i work on this module kept trying to load css/js etc... over http instead of https, regardless of the activation of the https proto in the domain settings or the various ways of forcing https in the settings.php file. – user2082382 Jul 5 '16 at 7:35
  • 1
    Drupal 7 doesn't use $base_url so this setting does nothing, $base_url is a Drupal 6 artifact. – Diogenes Oct 2 '17 at 17:52
1

if everything(SERVER AND HOST SETTINGS) is ok just $conf['https'] = TRUE; in your settings.php.

According to Enabling HTTP Secure (HTTPS)

Drupal configuration :

If you want to support mixed-mode HTTPS and HTTP sessions open up sites/default/settings.php and add $conf['https'] = TRUE;. This enables you use the same session over HTTP and HTTPS both -- but with two cookies where the HTTPS cookie is sent over HTTPS only. You will need to use contributed modules like securepages to do anything useful with this mode, like submitting forms over HTTPS and so on. While your HTTP cookie is still vulnerable to all usual attacks, a hijacked insecure session cookie can only be used to gain authenticated access to the HTTP site. It will not be valid on the HTTPS site. Whether this is a problem or not depends on the needs of your site and the various module configurations. For example, if all forms are set to go through HTTPS and your visitors can see the same information as logged in users then this is not a problem.

For even better security, leave $conf['https'] at the default value (FALSE) and send all authenticated traffic through HTTPS and use HTTP for anonymous sessions. Once again contributed modules like Secure Login or 443 Session can help you here. Drupal 7 automatically enables the session.cookie_secure PHP configuration on HTTPS sites, which causes SSL-only secure session cookies to be issued to the browser. For best-possible security, set up your site to only use HTTPS, and respond to all HTTP requests with a redirect to your HTTPS site. $conf['https'] can be left at its default value (FALSE) on pure-HTTPS sites. Even then, HTTPS is vulnerable to man-in-the-middle attacks if the connection starts out as a HTTP connection before being redirected to HTTPS. Use the HSTS module or set the Strict-Transport-Security header in your webserver to help prevent users from accessing the site without HTTPS.

also you can use Secure Pages module

Description of module :

A small process which will redirect the required pages to a SSL version of the page.

Update also you can in settings.php do: $base_url = 'https://'.$_SERVER['SERVER_NAME'];.

| improve this answer | |
  • posting answer below – noah Aug 9 '15 at 10:36
  • @noah Then what happened? – Yuseferi Aug 9 '15 at 10:38
  • with the dynamic base_url, https:// is always loaded, and domain access still has control over setting the subdomain plus, in the drupal docs it says "or best-possible security, set up your site to only use HTTPS, and respond to all HTTP requests with a redirect to your HTTPS site. $conf['https'] can be left at its default value (FALSE) on pure-HTTPS sites. " if setting conf[https] is for using mixed mode, we require an https only site. i think there is another issue involved with drupal loading our server assets over http, – noah Aug 9 '15 at 10:39
  • 1
    @noah also you can set auto redirect in your custom module in 'hook_init' and redirect every page to https ( but I think better way is achieve it in .htacess ) – Yuseferi Aug 9 '15 at 10:45
  • Don't use hook_init. Use .htaccess. – Kevin Mar 2 '16 at 15:11
0

The Secure Pages module does this.

A small process which will redirect the required pages to a SSL version of the page.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.