5

I installed Secure Pages on a site, where I need to secure admin and user login pages. In general, it does its job, but when the user first tries to log in, and goes to the /user page, that page is not redirected to the secure page. The form action attribute is rewritten to the corresponding https link though.

Do you have any ideas why this could be happening?

In Secure Pages config, I use 'Make secure only the listed pages' option, and tried 'user', 'user*', and 'user/*'. Base urls are blank, but I tried filling them in. There are entries in 'ignore pages', but I tried removing them.

Another thing I noticed is that it works when the user is logged in. Could be a permission issue, but I did not see any relevant permission.

Improve this question
2
  • 1
    For which Drupal version are you interested? This seems a bug in the module, and Drupal Answers doesn't replace the project issue queue in drupal.org.
    – avpaderno ♦
    Commented May 9, 2011 at 19:49
  • kiamlaluno, 6.20; the module's version is 6.x-1.9.
    – gergely
    Commented May 9, 2011 at 23:38

2 Answers 2

Reset to default
2

We had a similar issue as well on some of our drupal 6 sites and IE8 not redirecting to HTTPS, our solution was to use a custom URL alter to physically rewrite the URL's on the page to the HTTPS

@see the issue http://drupal.org/node/893840 and here is a link to the patch that we used - http://drupal.org/files/issues/893840-6-securepages.urlalter.patch. The patch adds a dependency on the https://drupal.org/project/url_alter module

A nice side effect is that a bootstrap is no longer required to do a silly redirect ;)

Improve this answer
2
  • Thanks, wiifm. You pointing out that this does not require a bootstrap has given me the incentive to go with the rewriting approach.
    – gergely
    Commented May 20, 2011 at 18:14
  • No worries, the saving of a bootstrap won't make a difference to small sites, but large sites that can only survive as boost offloads all the page requests - this patch is HUGE. If the patch works for you can you leave a comment on the issue queue? It would be nice to have this patch in securepages for all to use.
    – wiifm
    Commented May 21, 2011 at 1:22
2
+25

I just did a fresh Drupal 6 install with the latest Secure Pages module. Only modules enabled are default core + Secure pages. I did not modify permissions in any way.

Using the default Secure Pages settings, including

user
user/*

in the "Pages:" textarea, navigating to /user while logged out presents me with the user login form on a secure page, and logging in sends me back to the home page (where I started).

How are you redirecting your users to their /user profile upon login? Logintoboggan or some such? Let me know and I'll dig further.

Improve this answer
3
  • can we get any confirmation, does this answer the question?
    – Alex Weber
    Commented May 14, 2011 at 23:03
  • Entendu, thanks for your research. On my site no combination of user, user*, and user/* seems to do the trick. The /user page is reached via a link before the user is logged in, and it is really the login form that does not show up on a secured page, not the profile page.
    – gergely
    Commented May 17, 2011 at 19:20
  • that's a shame...
    – Alex Weber
    Commented May 18, 2011 at 0:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.