2

I understand that the Secure Pages module allows you to let some pages use http and force others to use https. Assuming that is correct, is there any reason for me to use Secure Pages if I'm already forcing all requests to my domain to use https?

More info below if you need it, some of which is platform specific for my host:

I'm getting ready to launch a production ubercart ecommerce site using the Pantheon hosting platform. I want to make sure to be secure and fully PCI compliant, so I was following these guidelines which state that I need to use secure pages.

However, before that, I followed these guidelines to force https across my entire site, for all environments including dev/test. I don't mind a slight performance hit because I would rather be as secure as possible.

To force https I have added some code to my settings.php file and I have also created a page rule on Cloudflare to force requests to my domain to use https.

It's overkill but I also used the recommended code in the Pantheon documentation link above in my settings.php file to redirect all traffic to https.

The documentation for installing secure pages also raises several red flags for me.

  • It involves applying core patches that have failed tests and suggests that you can do them by hand, which seems unreliable to me.
  • Some of the instructions lack explanation and seem somewhat unreliable. Not trying to be mean, but where this concerns security, it makes me worry. For example, they mention that you need to change the $base_url parameter in settings.php file, but then go on to say "This option may or may not be necessary. Some have reported that they need it, others have reported it breaks caching of their site." Similarly, after telling you to add the Cookie Domain they say: "Some have made comments that this is not necessary, or causes issues with their site. It's a recommended setting, but not explicitly required." Another unclear sentence in the documentation is that after applying the core patches: "If everything worked, you should see some output like "hunk succeeded" or something like that and you're good to go." The idea of changing core and then not explicitly knowing if I've done it correctly or not seems very worrying to me.
  • One of the instructions is "Adding the Cookie Domain" but Pantheon documentation cited above also says that it "already handles the necessary environment settings to ensure that Drupal is aware the site is running under HTTPS and that user session cookies should be secured." So, there's no reason to worry about that step in the Secure Pages instructions, I believe.
  • Other instructions from Secure Pages involve changing .htaccess to force www or the bare domain, but I have already taken care of that by following the Pantheon documentation above and modifying my settings.php file. This seemed the more reliable way to go since Pantheon documentation says .htaccess is ignored by NGINX servers.

So since I am already forcing https across my entire site, and I correctly enabled credit card encryption by creating a folder outside of my document root, is that enough to be PCI compliant using the Ubercart Credit Card module without Secure Pages?

1

Frankly, I bypassed Secure Pages and just forced all traffic to be HTTPS via htaccess. I prefer all traffic to be forced HTTPS.

SecurePages generally works up front, but I have seen a lot of wacky behavior with it that I just don't bother anymore.

  • 1
    Cool, that's pretty much what I did, except that I used settings.php instead of htaccess because that is what was recommended by my host. Thanks! – dianedouglas Aug 27 '16 at 23:27
  • Pantheon doesn't support .htaccess, nginx doesn't use it. – blu Mar 18 at 20:17
0

... is there any reason for me to use Secure Pages ...?

No, in general, but here's one possible reason: to avoid needing your own SSL certificate and its associated cost and administration hassle. I'm currently working on a project, also hosted on Pantheon, where we do just this. We used Secure Pages to redirect the user to https for sensitive pages... user login, contact form, other forms.

So, as an example, when a user goes to https://example.com/user they get redirected to https://live-example.pantheonsite.io/user - registered users on this site are all organisation staff, or similar - it's no big deal for them to see the pantheonsite.io address.

The full implementation uses a combination of Secure Pages and some custom logic in settings.php. The latter primarily deals with overriding the configuration values for Secure Pages depending on the environment (local, dev, test, live). For example, when running on a local development machine it sets $conf['securepages_enable'] = 0;.

  • Installing the Secure Pages module does not grant you an SSL certificate, it merely has configuration and conditions under which a user is redirected to https instead of http. You still need an SSL certificate and HTTPS enabled hosting environment to actually be secure. Furthermore, it is generally advised these days to make everything HTTPS, instead of mixed. Again, this can all be achieved in .htaccess, with exclusions for local/dev urls. – Kevin Aug 28 '16 at 17:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.