Static block doesn't get cached correctly between SSL and non-SSL

Question

I'm having an issue where I insert an image into a static block using the WYSIWYG editor. This results in an image tag like this:

<img src="{{media url="image.jpg"}}" />

The problem is that with block caching enabled the block doesn't get cached individually for SSL and non-SSL pages. I.e. if I visit a non-SSL page first and visit the same page again with SSL enabled the src attribute will contain a non-SSL link resulting in the respective warnings (and no green padlock).

This works perfectly fine when the block caching is disabled.

I dug into this and discovered that Magento doesn't seem to generate separate cache ids for SSL and non-SSL requests. I did the following change:

--- app/code/core/Mage/Cms/Block/Block.php      2016-10-12 13:55:55.823302409 -1000
+++ app/code/local/Mage/Cms/Block/Block.php     2016-10-13 08:39:48.307225894 -1000
@@ -86,6 +86,7 @@
                 'CMS_BLOCK',
                 $blockId,
                 Mage::app()->getStore()->getCode(),
+                (int)Mage::app()->getStore()->isCurrentlySecure(),
             );
         } else {
             $result = parent::getCacheKeyInfo();

That fixes the problem. I don't think that this is the correct solution though as this would mean that SSL would be broken for all existing Magento installs (checked 1.9.3 code). Does anybody have an idea what I'm missing here?

Currently running 1.9.2.1 fully patched.

Answer 1

I didn't end up finding a solution I'm happy with. I'm certain I'm missing something because otherwise mixed SSL and non-SSL environments wouldn't work.

I settled on this solution for now:

--- app/code/core/Mage/Core/Block/Abstract.php  2016-10-20 10:36:59.660834474 -1000
+++ app/code/local/Mage/Core/Block/Abstract.php 2016-10-25 07:12:23.238775078 -1000
@@ -1292,15 +1292,15 @@
      */
     public function getCacheKey()
     {
-        if ($this->hasData('cache_key')) {
-            $cacheKey = $this->getData('cache_key');
-            if (strpos($cacheKey, self::CACHE_KEY_PREFIX) !== 0) {
-                $cacheKey = self::CACHE_KEY_PREFIX . $cacheKey;
-                $this->setData('cache_key', $cacheKey);
-            }
+        $secure = $this->_isSecure() ? '_ssl' : '_non_ssl';

-            return $cacheKey;
+        if ($this->hasData('cache_key')) {
+            $key = $this->getData('cache_key');
+            if (strpos($key, self::CACHE_KEY_PREFIX) !== 0) {
+                $key = self::CACHE_KEY_PREFIX . $key;
+                $this->setData('cache_key', $key);
         }
+        } else {
         /**
          * don't prevent recalculation by saving generated cache key
          * because of ability to render single block instance with different data
@@ -1310,7 +1310,9 @@
         $key = array_values($key); // ignore array keys
         $key = implode('|', $key);
         $key = sha1($key);
-        return $key;
+        }
+
+        return $key . $secure;
     }

     /**

Of course this is far from optimal but I figured it might be helpful to someone.

Answer 2

Reason

In most cases, some images or forms on the page are loaded over plain HTTP, without SSL. It can happen when CMS pages are edited by hand and some images or other resources pasted with absolute URL hardcoded with http:// protocol prefix instead of https:// or just //. In the worst cases, web-server configuration is incorrect or does not provide security level expected by browser

Find all non-SSL elements

Right click anywhere on your page, in context menu select View Source option. In source view page press ctrl+f and search for src="http:// or src='http:// or even src=http:// text:

YOUR CAN FIND ELEMENTS HERE

Replace all non-SSL calls with protocol-relative or SSL call

For every non-SSL resource replace its non-SSL call (http://) with protocol-relative (//) or forced SSL call (https://). In example, replace http://example.com/image.jpg with //example.com/image.jpg or https://example.com/image.jpg.

If non-SSL calls are made by code, i.e. getBaseUrl function, add array('_secure'=>true) option, so

<?php echo Mage::getBaseUrl(Mage_Core_Model_Store::URL_TYPE_LINK); ?>

should be like the following after adding it:

<?php echo Mage::getBaseUrl(Mage_Core_Model_Store::URL_TYPE_LINK, array('_secure'=>true)); ?>

Flush caches to apply changes