What would be the best practice way to redirect all logged in users to HTTPS? The login persists the site that's concerned. So if you login, come back to www.foobar.com a week later, you are still logged in - however, you'd be on the HTTP version.

The homepage on HTTP is not so much an issue - however can anyone suggest of ways to route the links HTTPS based on the logged in status? What would I need to override?

  • Magento should already re-direct those pages to https. Has something been changed to allow the extended logins that would prevent that? Seems like a bug, not something that should be fixed by simply re-directing. Also, wouldn't the extended login itself be a security issue? If someone were to use a friends' or public pc. Just a thought. – jesseconnr Feb 19 '14 at 19:12

the session is split basically in a "secure" (https) and a "unsecure" (http) session.

Anyway, to force HTTP or HTTPS you can do two things.

One is the HSTS header on all pages to tell the browser to force https. http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security This is obviously the best approach since it will make sure the browser itself knows that https shall be used in the future.

The other option is to use a simple module to determine if the user should be redirected either to the http or https version of the homepage, a good start might be https://github.com/AOEpeople/Aoe_ForceHttpProtocol. It's not much code you'll need, just a simple observer and a config.xml.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.