Current setup:

https://safe.mydomain.com
http://www.mydomain.com

What's on secure:
/user*
/checkout*

Rest is not on secure, including /cart and of course pages with the core login block.

The code from hook_form_alter in securepages.module:

<?php
  // If the user/login block matches, also secure the login block.
  if (securepages_match('user/login') && $form_id == 'user_login_block' && !$is_https) {
    $form['#https'] = TRUE;
  };?>

It adds the https, but it keeps the link, linking to https://www.mydomain.com that does not exist in current setup, thus effectively breaking the login block.

This also happens on the checkout button on /cart when /cart is not on https.

Comments

dnovotny’s picture

dnovotny commented

I am having the same problem.

My domains are:
http://domain.org
https://wwws.domain.org

and the form action is sending the login box to:
https://domain.org

I have tried with and without the $base_url in settings.php.

Edit: I found a temporary work-around by adding:

index
to my list of pages that should be secure.

farald’s picture

farald commented

Yep, we ended up doing the same. Basically, ensure no forms on unsecure redirect to a secure location. So, the login block had to go, and the /cart had to go into secure. Problem solved, but indeed a workaround. :)

izmeez’s picture

izmeez commented
Issue summary: View changes

I am having a similar problem with the core login block.

The core login block is displayed on a non-secure http://example.com front page.
After login when user goes to a secure page such as http://example.com/admin they get an access denied error and must login again now with the url showing as https://example.com

Is this because I need to add something to the settings.php file?

There is another related issue #345740: Should work with login toboggan block which seems to have been resolved but I do not understand what solved that.

Thanks.

izmeez’s picture

izmeez commented

Following the instructions on the securepages module page and ensuring that settings.php had the line

$conf['https'] = TRUE;

seems to have resolved the issue for me.

astonvictor’s picture

astonvictor commented
Status: Active » Closed (outdated)

I'm closing it because the issue was created a long time ago without any further steps.

if you still need it then raise a new one.
thanks