force anonymous users back to HTTP without necessarily forcing authenticated users to HTTPS [#1237598]

Not sure if this is the expected behavior, but I have only the cart* pages set to be secure (everything else is disabled). Once I browse the a cart page the url changes fine, from http to https. However when I browse from a cart page back to an unsecured page, the url says as https. Is this expected?

This is different from uc_ssl module where url of the cart pages stay at https... and when you browsing back to an unsecure page, the url changes to http.

Can someone comment on the different behavior between this module and the uc_ssl module?

Comments

Comment #1

dalin

he/him

English

🇨🇦, 🇲🇽, 🌍

commented 3 August 2011 at 03:12

Status:

Active

» Postponed (maintainer needs more info)

Can you elaborate on the other settings for 443 Session module? I think your answer lies there.

Comment #2

nelslynn commented 3 August 2011 at 04:29

Settings:
Enabled - Redirection may happen according to the rules below.
User State: Do not redirect to HTTP or HTTPS based on user state.
Login Block: Don't do any manipulations of the login block. Passwords will not be transmitted securely. (I use FancyLogin Module)
Additional pages to make secure: cart*

I've also tried this option for User State: "Redirect authenticated users to HTTPS and redirect anonymous users to HTTP (with the exception of login/registration pages).", and once at https://mysite.com/cart all pages stay at https for anonymous users. Before browsing to the cart page, all pages are http://

Edit:
Also, with this setting:
User State:
Redirect authenticated users to HTTPS and redirect anonymous users to HTTP (with the exception of login/registration pages).
I cannot browse to any page without https:// .. all pages are forced to secure. This may however be because I'm using the FancyLogin module (where the login is hidden on every page), and ALL pages may be considered a login page?

Comment #3

hitfactory commented 3 August 2011 at 04:17

Same problem here. My settings:

User state: Do not redirect to HTTP or HTTPS based on user state.
Login block: Force all pages with the login block to use HTTPS.
Additional pages to make secure: (Have about ten webform paths listed here)
Ignore page: default settings plus

In case it matters, this is on a multilingual site where each language is a different domain (.com, .de, .es, etc)

What happens is:

http://example.com -> https://example.com/someform -> https://example.com/anypage

Once I hit one page that needs https, I can't get out of it.

Comment #4

dalin

he/him

English

🇨🇦, 🇲🇽, 🌍

commented 4 August 2011 at 05:09

Title:	https back to http not working	» force anonymous users back to HTTP without necessarily forcing authenticated users to HTTPS
Version:	6.x-1.x-dev	» 7.x-1.x-dev
Category:	support	» task
Status:	Postponed (maintainer needs more info)	» Postponed

Hmmmm. The keyword here is "additional". Currently 443 Session module is primarily intended to force authenticated users to HTTPS and anonymous users to HTTP. You can also force anonymous users to HTTPS on some _additional_ paths.

However you bring up a good point. In order for 443 Session module to be able to completely replace Secure Pages it will need to be able to force anonymous users back to HTTP without necessarily forcing authenticated users to HTTPS. However I think this will have to wait until after the D7 branch gets ported and stable.