I understand that the Secure Pages module allows you to let some pages use http and force others to use https. Assuming that is correct, is there any reason for me to use Secure Pages if I'm already forcing all requests to my domain to use https?
More info below if you need it, some of which is platform specific for my host:
I'm getting ready to launch a production ubercart ecommerce site using the Pantheon hosting platform. I want to make sure to be secure and fully PCI compliant, so I was following these guidelines which state that I need to use secure pages.
However, before that, I followed these guidelines to force https across my entire site, for all environments including dev/test. I don't mind a slight performance hit because I would rather be as secure as possible.
To force https I have added some code to my settings.php file and I have also created a page rule on Cloudflare to force requests to my domain to use https.
It's overkill but I also used the recommended code in the Pantheon documentation link above in my settings.php file to redirect all traffic to https.
The documentation for installing secure pages also raises several red flags for me.
- It involves applying core patches that have failed tests and suggests that you can do them by hand, which seems unreliable to me.
- Some of the instructions lack explanation and seem somewhat unreliable. Not trying to be mean, but where this concerns security, it makes me worry. For example, they mention that you need to change the $base_url parameter in settings.php file, but then go on to say "This option may or may not be necessary. Some have reported that they need it, others have reported it breaks caching of their site." Similarly, after telling you to add the Cookie Domain they say: "Some have made comments that this is not necessary, or causes issues with their site. It's a recommended setting, but not explicitly required." Another unclear sentence in the documentation is that after applying the core patches: "If everything worked, you should see some output like "hunk succeeded" or something like that and you're good to go." The idea of changing core and then not explicitly knowing if I've done it correctly or not seems very worrying to me.
- One of the instructions is "Adding the Cookie Domain" but Pantheon documentation cited above also says that it "already handles the necessary environment settings to ensure that Drupal is aware the site is running under HTTPS and that user session cookies should be secured." So, there's no reason to worry about that step in the Secure Pages instructions, I believe.
- Other instructions from Secure Pages involve changing .htaccess to force www or the bare domain, but I have already taken care of that by following the Pantheon documentation above and modifying my settings.php file. This seemed the more reliable way to go since Pantheon documentation says .htaccess is ignored by NGINX servers.
So since I am already forcing https across my entire site, and I correctly enabled credit card encryption by creating a folder outside of my document root, is that enough to be PCI compliant using the Ubercart Credit Card module without Secure Pages?
