Closed (works as designed)
Project:
Secure Pages Hijack Prevention
Version:
6.x-1.5
Component:
Code
Priority:
Normal
Category:
Bug report
Assigned:
Reporter:
Created:
2 Aug 2010 at 13:19 UTC
Updated:
29 Apr 2011 at 21:20 UTC
This module doesn't work with Ajax Login/Register ( http://drupal.org/project/ajax_register ). Even if base_url is set to:
$base_url = ((isset($_SERVER['HTTPS']) && $_SERVER['HTTPS']=='on') ? 'https://' : 'http://') . 'www.mysite.com';
Comments
Comment #1
YK85 commentedsubscribing
Comment #2
damienmckennaSubscribe.
Comment #3
grendzy commentedYou can try adding ajax_register/* to the "ignore" list in the securepages settings.
This may be fundamentally insoluble, however. In order to generate a secure cookie, the session must be created on a secure page. However, you cannot make a secure XHR (ajax request) from an insecure page - this is a violation of the same-origin policy:
https://developer.mozilla.org/en/Same_origin_policy_for_JavaScript