I am wondering how magento determines which page should be secure & which page should be unsecure.

From what i understand, magento only makes the checkout & login page as secure by default & i can make other pages secure by specifying them under the config path frontend/secure_url/.... via my module's config.xml

The admin-side configuration seems to be fine. SSL is enabled in both frontend & backend. The backend is fully over https. In the frontend most pages work fine under http including the homepage, & the checkout & login pages are redirected to https as expected.

But there are a few other url's getting redirected to https that i was expecting to remain on http including a custom module's controller/action.

I need some pointers on how to debug this? Is there any other config i can use to stop them from being redirected?

  • Could you give some examples/code (e.g. the custom module's XML config)? Also, I would not speak of "debugging" when you try to redirect https:// to http:// ;) Feb 4, 2014 at 21:27

2 Answers 2


There is a function just for that, called shouldUrlBeSecure located in app/code/core/Mage/Core/Model/Config.php on line 1477.

Here is the complete function:

 * Check whether given path should be secure according to configuration security requirements for URL
 * "Secure" should not be confused with https protocol, it is about web/secure/*_url settings usage only
 * @param string $url
 * @return bool
public function shouldUrlBeSecure($url)
    if (!Mage::getStoreConfigFlag(Mage_Core_Model_Store::XML_PATH_SECURE_IN_FRONTEND)) {
        return false;

    if (!isset($this->_secureUrlCache[$url])) {
        $this->_secureUrlCache[$url] = false;
        $secureUrls = $this->getNode('frontend/secure_url');
        foreach ($secureUrls->children() as $match) {
            if (strpos($url, (string)$match) === 0) {
                $this->_secureUrlCache[$url] = true;

    return $this->_secureUrlCache[$url];

To see which URLs should be secure you can add a simple Mage::log($secureUrls) inside the if statement. This is what my log entry looked like:

2014-02-12T11:55:26+00:00 DEBUG (7): Mage_Core_Model_Config_Element Object
    [install] => /install/wizard/checkSecureHost
    [customer] => /customer/
    [sales] => /sales/
    [authorizenet_paygate] => /paygate/authorizenet_payment
    [checkout_onepage] => /checkout/onepage
    [checkout_multishipping] => /checkout/multishipping
    [paypal_express] => /paypal/express
    [paypal_standard] => /paypal/standard
    [paypal_express_callbackshippingoptions] => paypal/express/callbackshippingoptions
    [googlecheckout_redirect] => /googlecheckout/redirect/
    [googlecheckout_beacon] => /googlecheckout/api/beacon/
    [googlecheckout_api] => /googlecheckout/api/
    [review_customer] => /review/customer/
    [tag_customer] => /tag/customer/
    [wishlist] => /wishlist/
    [paypaluk_express] => /paypaluk/express
    [rss_catalog_review] => /rss/catalog/review
    [rss_order_new] => /rss/order/new
    [rss_catalog_notifystock] => /rss/catalog/notifystock
    [centinel] => /centinel/
    [newsletter_manage] => /newsletter/manage/
    [downloadable] => /downloadable/customer/
    [downloadable_download] => /downloadable/download/
    [ogone_api] => /ogone/api
    [persistent_onepage_register] => /persistent/index/saveMethod
    [checkout_cart] => /checkout/cart
    [storecredit_info] => /storecredit/info/
    [giftcard_customer] => /giftcard/customer/
    [enterprise_pbridge_pbridge] => /enterprise_pbridge/pbridge/
    [invitation] => /invitation/

Now to figure out how Magento switches HTTP to HTTPS I think you would most likely have dive into the Zend framework in the lib inside lib/Zend/Http/* because it contains files of most interest. Well, anyway hope this helped. Good luck!


If,you want to used for secure url for any other modules then you need to some change in config.xml of that modules.. First for frontend used tags


And ,if you for productfaq url then change $this->getUrl('productfaq/index/index', array('_secure'=>true));

My extension path \app\code\local\Amit\Productfaq\etc.

In config.xml need to change below

        <!-- add secure url for extesnion, for that  
url productfaq automatically appnend https:  -->

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.