I'm running drupal 7 with the secure login module and login toboggan. After installing it, going to http://site.com I see the usual site, with the login button.
The login form
action has not changed, it remains a POST to
/node?destination=node. Sure enough, if I login there my password is sent in the clear with a POST to
Any ideas on how I might start debugging this? The securelogin.module seems really straightforward, just some hooks. Is there a logging statement I can add there to see if these hooks are being called?
update I also noticed this other problem (probably the same cause).
Sometimes when I start a fresh browser and go to http://site.com I get 302's to https://site.com automatically. If I then log in the POST goes over https (good!) but I then get 302'd back to http://site.com, where I appear NOT logged in. If I just change the URL to https://site.com I can see that I am indeed logged in.
I am very confused.