"Enable Secure Pages" greyed out - no _SERVER["HTTPS"] on phpinfo...Dunno what to do!

Apparently it has something to do with Shared SSL (which I use).
Huh.

Hi,

This has nothing to do with the shared SSL.
This code:

returned no $_SERVER['HTTPS']
When I run phpinof(); using Shared SSL $_SERVER[SERVER_PORT] => 443 but $_SERVER['HTTPS'] is not visible.

I kept digging and found a couple of posts suggesting an issue with the hosting. Something about the load balancer dealing with SSL making it transparent to the Web Server.

I found two links that may help you if you have access to your Apache configuration files:
http://www.mellonway.com/Apache2_SSL_Proxy_for_Drupal
and:

Keyword -- Load Balancer

The problem boils down to the fact that the load balancer is handling SSL encryption/decryption and it is completely transparent to the webserver.

Request: Client -> 443or80 -> loadbalancer -> 80 -> php
Response: PHP -> 80 -> loadbalancer -> 443or80 -> Client
The real question here is "do you have control over the load balancer configuration?"

If you do, there are a couple ways to handle it. Configure the load balancer to have seperate service definitions for HTTP and HTTPS. Then send HTTP traffic to port 80 of the web servers, and HTTPS traffic to port 81 of the webservers. (port 81 is not used by anything else).

In apache, configure two different virtual hosts:

ServerName foo.com
SetEnv USING_HTTPS 0
...

ServerName foo.com
SetEnv USING_HTTPS 1
...

Then, the environment variable "USING_HTTPS" will be either 1|0, depending on which virtual host picked it up. That will be available in the $_SERVER array in PHP. Isn't that cool?

If you do not have access to the Load Balancer configuration, then things are a bit tricker. There will not be a way to definitively know if you are using HTTP or HTTPS, because HTTP and HTTPS are protocols. They specify how to connect and what format to send information across, but in either case, you are using HTTP 1.1 to make the request. There is no information in the actual request to say if it is HTTP or HTTPS.

But don't lose heart. There are a couple of ideas.

The 6th parameter to PHP's setcookie() function can instruct a client to send the cookie ONLY over HTTPS connections (http://www.php.net/setcookie). Perhaps you could set a cookie with this parameter and then check for it on subsequent requests?

Another possibility would be to use javascript to update the links on each page depending on the protocol (adding a GET parameter).

(neither of the above would be bullet proof)

Another pragmatic option would be to get your SSL on a different domain, such as "secure.foo.com". Then you could resort to the VirtualHost trick above.

I know this isn't the easiest issue because I deal with it during the day (load balanced web cluster behind a Cisco CSS load balancer with SSL module).

Finally, you can always take the perspective that your web app should switch to SSL mode when needed, and trust the users NOT to move it back (after all, it is their data on the line (usually)).

Hope it helps a bit.

Posted by gahooa http://stackoverflow.com/users/64004/gahooa on
http://stackoverflow.com/questions/552162/detecting-https-vs-http-on-ser...

If anyone thinks of something else...

Thanks

Ah yes, we went through this with our new host. If they are using a load balancer you have to actually enable the secure ports 443 (and sometimes 8443) in the config itself. That's not a Drupal issue per se but something you should contact your host about.

Hi,

Some people are going to say we should use Secure Pages module and I agree. Unfortunately some times it does not work because of the web hosting services...
After a few days googling I found a work around using .htaccess

This code will make sure that you stop using HTTPS when you are not in the checkout, the login or the user pages !(cart/checkout|user|login):

This code will make sure that you START using HTTPS when you are in the checkout, the login or the user pages (cart/checkout|user|login):

Note that you can use as many pages needed in https/http by including their name inside the (pagename1|pagename2|pagename3|....|....|....). Make sure to separate the page names using |.