Download & Extend

SecurePages with OpenID Module and "Switch back to http" checkbox enabled

Project:Secure Pages
Version:5.x-1.6
Component:Code
Category:feature request
Priority:minor
Assigned:Unassigned
Status:closed (works as designed)

Issue Summary

Kind of an FYI and feature request in one.

FYI

I loaded up SecurePages and OpenID Module along with a self-sign SSL certificate. The purpose of which was to to secure Drupal user logins while still offering the option to use a OpenID login.

Out of the box, it seems to work fine with both modules enabled and the "Switch back to http pages when there are no matches" option disabled on /admin/settings/securepages.

However, with "Switch back to http pages when there are no matches" enabled I found trying to login with OpenID would start processing and then redirect to http://www.example.com/server (where example.com is the Drupal server doamin) and generate a 404 Page Not Found. I looked through some of the code for the OpenID module and didn't see anything about redirecting to a /server page, so that is still a mystery. However, I did find that adding

server
openid*

to the "Make secure only the listed pages." textarea while "Switch back to http" is enabled actually fixed the issue I was experiencing with the 404 on the /server page.

Feature Request

Figure I'd ask if addressing this issue with OpenID could/should be handled on the SecurePages side with a patch, documentation, or user notification. Again, I'm using a self-signed certificate, though I doubt a signed cert would be any different. So, if others are able to replicate this issue then perhaps adding in some code like

if ( module_exists('openid') ) {
// 1: force encryption of server and openid* pages
// And/Or
// 2: throw up a drupal_set_message() to warn/inform the admin on install and/or better yet on /admin/settings/securepages
}

Conclusion

I'm not sure if handling exceptions for various modules is an acceptable request or if this request would be better handled on the /project/openid side. Anyway, thought I'd share my findings and see if it sounded like something worthy of a patch or if it's worth collaborating with the folks who made the OpenID module. I would be willing to follow up with them if this issue is valid and worthy of a fix.

Thanks,
Jim

Comments

#1

I probably should have mentioned my exact configuration.

Enable Secure Pages: set to Enabled

Pages which will be be secure: set to "Make secure only the listed pages." and Pages: set to

user
user/*
server
openid*

Ignore pages: set to */autocomplete/*

Drupal 5.7 and SecurePages 5.x-1.6 and OpenID 5.x-1.1

#2

Status:active» closed (works as designed)

Probably 5.x version is no longer supported.
Check the solution for: 6.x
#1093164: OpenID login failed. when using with SecurePages

nobody click here