When you use Securepages and Boost it is a good idea to skip SSL for boost rewrites. If you do this it allows secure pages to redirect back to SSL when it counts. Otherwise you might run into issues with requesting SSL and have images or other files using NON ssl and creating warnings in IE.

Once I enabled this everything on my site worked great. I am using Civicrm and taking transactions.

# Skip boost IF not get request OR uri has wrong dir OR cookie is set
RewriteCond %{REQUEST_METHOD} !^GET$ [OR]
RewriteCond %{REQUEST_URI} (^/(admin|cache|misc|modules|sites|system|themes))|(/(comment/reply|user|user/(login|password|register))$) [OR]
RewriteCond %{HTTPS} on [OR] # <--- added this
RewriteCond %{HTTP_COOKIE} DRUPAL_UID
RewriteRule .* - [S=9]

CommentFileSizeAuthor
#4 516670-4-Boost_conditional_skip_ssl.patch3.82 KBzhangtaihao
#1 boost-516670.patch2.82 KBmikeytown2

Comments

mikeytown2’s picture

mikeytown2 commented
Status: Active » Needs review
StatusFileSize
new boost-516670.patch2.82 KB

Interesting point that makes since for the vast majority of sites out there.

mikeytown2’s picture

mikeytown2 commented
Status: Needs review » Fixed

committed

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

zhangtaihao’s picture

zhangtaihao commented
Version: 6.x-1.0-beta2 » 6.x-1.x-dev
Status: Closed (fixed) » Active
StatusFileSize
new 516670-4-Boost_conditional_skip_ssl.patch3.82 KB

In my server environment I actually have a few exceptions to this rule. I would put HTTPS into a separate condition, augmented by an environment variable. If the environment variable BOOST_HTTPS is "on", Boost will not be bypassed for HTTPS requests. This is useful for shared platforms where one code base potentially hosts many sites. You would simply configure specific virtual hosts (or other more granular conditions) to use Boost for HTTPS with SetEnvIf/SetEnvIfNoCase for the BOOST_HTTPS variable.

I've attached a patch for what I use.

patrickroma’s picture

patrickroma commented

Hi there,

I am still getting this problem with the frontpage... I just want my frontpage to be delivered in http:// not https://. Whenever I jump back from a SSL-Webform-Node to the front - the front-page is not changing back to http... all other pages work. I tried with different patches - without success so far. Any help would be really appreciated.

zhangtaihao’s picture

zhangtaihao commented

It might be a combination of your Secure Pages configuration and Apache configuration (check to see if it's Apache forcibly redirecting or Secure Pages). Also, just in case you're behind a reverse proxy, check to see the reverse proxy actually correctly forwards the HTTPS environment variable to your web server.