Hello-
I have a Plesk server that I will use for Drupal. Plesk handles http and https a little different from standard Apache: the http and https are actually different folders. Normally, one would either a) install 2 copies of the web site with the things that need to be secure (ie. shopping cart) only in https; or b) create a symlink so that there's only one directory that's accessable to both http and https.
This causes a problem for me with Drupal:
I don't want to maintain 2 copies of the code as in option A above; and if I use option B, then the store COULD be accessed if someone were to type in HTTP://domain.com/store, even though all the links would be https. I might be able to handle this via mod rewrite in htaccess, but I think that could get pretty messy as the number of products grows (watch for /node/x, print/x, /prodname, etc. for each product).
So here's the questions:
How's everyone else doing it? and What kind of performance hit might I expect if I were to just run the entire site over SSL?
Thanks for your opinions.
Comments
SSL
I use SSL and Plesk extensively on a number of my projects. Wrote an article about SSL and Drupal ('CivicSpace') integration over here http://civicspacelabs.org/home/node/14096.
If you want to get around the Plesk 2 directories issue, use a symbolic link to point from the httpsdocs directory to httpdocs. That way, you will always be on the same code base. This kind of breaks Plesk, but it's something most people can live with. An alternative is to install Drupal and mirror the files directory in the httpdocs directory, which is typically the only collection of content that is not in sync with both sites.
In terms of a performance hit, you are not looking at much. I offload http authentication to a separate server which drastically decreases the hit the server takes.
M
But...
Right, I thought about the symlink, but couldn't someone type in HTTP for the url and get to the store in non-ssl? All of the links to the store would be HTTPS, but that doesn't stop you from typing the url directly.
My question exactly
My question exactly. Is there a way to force(redirect?) to https on certain pages?
-zach
------------------------
harkey design
: z
Nevermind, I see that this
Nevermind, I see that this is covered in the linked article:
Securing CivicSpace in a Couple of Easy Steps
-zach
------------------------
harkey design
: z
Link Broken
That website is not existing anymore. Is there somewhere else to read your article?