User login page not secured

Posted by shanefjordan on November 11, 2010 at 4:58am

5 followers

Issue Summary

I've installed this module and configured it to work with user* as I read in another post to secure the user login page. The issue I'm having is that it does not secure the /user page until I visit "Create New Account" or another secure page. I even tried adding "user" into the list without any wild card, just hoping to get it to work. Any ideas on what to try?

Thanks,
Shane

Comments

#1

Posted by izzysanime on February 15, 2011 at 11:48pm

Hi, Same problem here.

I have the following in the list

user
user*
user/*

I noticed for me, that the url is actually https, however firefox will say that the page is only partially encrypted.

Thanks,
Josh

#2

Posted by adr_p on May 26, 2011 at 12:16pm

Status:

active

» needs review

Please see http://drupal.org/node/587000#comment-4519010.

#3

Posted by grendzy on August 23, 2011 at 6:49pm

Category:	bug report	» support request
Status:	needs review	» postponed (maintainer needs more info)

I haven't been able to reproduce this - more details are needed.

#4

Posted by James Andres on August 30, 2011 at 4:07pm

I've just installed securepages and had the same experience (/user is not secured, but /user/login; /user/register and /user/password are secured). I think I have an idea of what is going on here.

The trouble is the default variable settings for the "securepages_pages" variable differs throughout the code. In the securepages_match() function the /user path is not secured by default; however, on the admin page it appears that /user IS secured by default. So for any user who never clicks the "Save" button on the admin page they will get this odd behaviour.

Here is a patch which makes them all the same.

Attachment	Size
65632-4-securepages-user_page_isnt_secure.patch	599 bytes

#5