I have Drupal site with a login form on my home page.
How do I go about posting to a HTTPS url, and then after a successful authentication, redirect back to HTTP admin page?
-
Does this answer your question? How do I simply make the whole site use a secure connection?– leymannxCommented Mar 11, 2021 at 21:38
Add a comment
|
4 Answers
Given the way things are heading on the internet now, and Google making statements about weighing HTTPS sites higher than HTTP in the past couple of months, you might as well make it totally HTTPS.
You don't want to log in on HTTPS then redirect back to HTTP, you'll have issues with people being logged in and out intermittently. People have tried to address this issue over the years, but I don't think it has ever been solved.
I would set HTTPS always on and handle it in .htaccess, redirecting any non HTTPS traffic to HTTP. (to clarify, you do not need a module to do any of this - just follow the instructions in .htaccess and work with your hosting provider to provide an SSL cert).
-
I would go (and in fact do go) with full HTTPS. Trying to mix them ends up being a huge headache, at least in D7.– JaypanCommented Sep 12, 2016 at 23:47
-
It's simply easier to force HTTPS and not bother with modules trying to figure it out for you.– KevinCommented Sep 12, 2016 at 23:58
-
-
It's not going to matter as much going forward. There will come a time when there is no choice. Google and others will begin requiring https or penalize the site in various ways. HTTP/2 should also help speed and some studies show it can even be as fast or faster under HTTPS.– KevinCommented Sep 14, 2016 at 22:34
If you want to view the /user (login) page on https and you already have a certificate available. Installing the certificate and using the https://www.drupal.org/project/securepages module.
But... when logging in via https i wouldn't recommend redirecting back to https in the admin side of things.
What would be an option, and is possible with that module is, when not logged in just using the secure pages (https) for webforms / login forms etc. (every page that requires user input).
Use Secure Login
For sites that are available via both HTTP and HTTPS, Secure Login module ensures that the user login and other forms are submitted securely via HTTPS, thus preventing passwords and other private user data from being transmitted in the clear. Secure Login module locks down not just the user/login page but also any page containing the user login block, and any other forms that you configure to be secured.
For Drupal 7 and 8, Secure Login module enforces secure authenticated session cookies, thus preventing session hijacking by eavesdroppers. For previous versions of Drupal, PHP's session.cookie_secure flag must be enabled on the HTTPS site to enforce secure session cookies.
answered Sep 12, 2016 at 18:46
To strictly do what you are asking, I would recommend the secure pages module. You will need to make sure that your web server setup is correctly configured to use https. Contrary to another answer, it is definitely possible and can work quite well, once it is all configured. There are many caveats, though, such as getting sessions to correctly share between http and https.
All in all, though, in this day and age I would heartily recommend to not bother and just run the entire site through https. The overhead of encryption is not a factor anymore with modern hardware, and since it allows the use of http 2, it can actually be faster than plain old http. Also, it is starting to have small SEO benefits to have your site accessible through https (Google has announced over a year ago that they will give pages some extra ranking when they are https).
