If you run two URLs with Domain module like e.g.


main.site.com is main site, so if you go to sub.site.com/user and login, it redirects back to main.site.com. This happens because $base_url is set to main.site.com.

We don't want to leave $base_url off to make this work for security reasons, so it's not a solution. Also leaving it off doesn't pass the Security Review tests.

Found this thing called dynamic $base_url like so documented at https://www.drupal.org/project/domain/issues/2530212#comment-10200897 and https://www.drupal.org/project/domain/issues/633726#comment-10200903

Tried implementing the 'https://'.$_SERVER['SERVER_NAME']; but no effect, it still redirects. Our sites do run on HTTPS and on Nginx.

Nginx block looks like this:

server {
  listen 80;
  server_name main.site.com;
  server_name sub.site.com;
  return 301 https://main.site.com$request_uri;

server {
  listen 443 ssl http2;
  root /var/www/main.site.com/htdocs/;

  server_name main.site.com;
  server_name sub.site.com;

What is missing out?

  • Your options are clearly outlined in your cited links. You can NOT set this value manually in your settings.php but have to leave it to the domain access module's conf_init() implementation. Automated tests as conducted by the security review module can cover specific (most often seen) use cases only. They can't support all possible variations. – Mario Steinitz Aug 23 '18 at 23:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.