SecurePages with OpenID Module and "Switch back to http" checkbox enabled
| Project: | Secure Pages |
| Version: | 5.x-1.6 |
| Component: | Code |
| Category: | feature request |
| Priority: | minor |
| Assigned: | Unassigned |
| Status: | active |
Jump to:
Kind of an FYI and feature request in one.
FYI
I loaded up SecurePages and OpenID Module along with a self-sign SSL certificate. The purpose of which was to to secure Drupal user logins while still offering the option to use a OpenID login.
Out of the box, it seems to work fine with both modules enabled and the "Switch back to http pages when there are no matches" option disabled on /admin/settings/securepages.
However, with "Switch back to http pages when there are no matches" enabled I found trying to login with OpenID would start processing and then redirect to http://www.example.com/server (where example.com is the Drupal server doamin) and generate a 404 Page Not Found. I looked through some of the code for the OpenID module and didn't see anything about redirecting to a /server page, so that is still a mystery. However, I did find that adding
server
openid*to the "Make secure only the listed pages." textarea while "Switch back to http" is enabled actually fixed the issue I was experiencing with the 404 on the /server page.
Feature Request
Figure I'd ask if addressing this issue with OpenID could/should be handled on the SecurePages side with a patch, documentation, or user notification. Again, I'm using a self-signed certificate, though I doubt a signed cert would be any different. So, if others are able to replicate this issue then perhaps adding in some code like
if ( module_exists('openid') ) {
// 1: force encryption of server and openid* pages
// And/Or
// 2: throw up a drupal_set_message() to warn/inform the admin on install and/or better yet on /admin/settings/securepages
}Conclusion
I'm not sure if handling exceptions for various modules is an acceptable request or if this request would be better handled on the /project/openid side. Anyway, thought I'd share my findings and see if it sounded like something worthy of a patch or if it's worth collaborating with the folks who made the OpenID module. I would be willing to follow up with them if this issue is valid and worthy of a fix.
Thanks,
Jim

#1
I probably should have mentioned my exact configuration.
Enable Secure Pages: set to Enabled
Pages which will be be secure: set to "Make secure only the listed pages." and Pages: set to
useruser/*
server
openid*
Ignore pages: set to */autocomplete/*
Drupal 5.7 and SecurePages 5.x-1.6 and OpenID 5.x-1.1