1

I'm running drupal 7 with the secure login module and login toboggan. After installing it, going to http://site.com I see the usual site, with the login button.

The login form action has not changed, it remains a POST to /node?destination=node. Sure enough, if I login there my password is sent in the clear with a POST to http://site.com/node?destination=node

Any ideas on how I might start debugging this? The securelogin.module seems really straightforward, just some hooks. Is there a logging statement I can add there to see if these hooks are being called?

update I also noticed this other problem (probably the same cause).

Sometimes when I start a fresh browser and go to http://site.com I get 302's to https://site.com automatically. If I then log in the POST goes over https (good!) but I then get 302'd back to http://site.com, where I appear NOT logged in. If I just change the URL to https://site.com I can see that I am indeed logged in.

I am very confused.

2

To force SSL for login, admin, node editing etc, I use http://drupal.org/project/securepages - also has has configuration options to force plain HTTP when browsing the site as well (which can save you load).

0

Ok, the problem seems to have been that I had $base_url = 'http://site.com' set in my settings.php.

This resulted in that, after a successful login on https, the user got 302'd back to an http: page which showed him as not logged in. By commenting out the base_url the re-direct now sends the user back to an https and shows him logged in. So, it all seems to work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.