1

I have a whole shop set up under https (unsecure and secure URL set to https), because 1) I do not see why not and 2) I use a theme from themeforest which has problems with mixing http and https (exclamation mark in the address bar because of mixed secure and unsecure content, and ugly security warning when putting stuff into the shopping cart).

Unfortunately, the shop POS system can ONLY use the API via http (yes, seems out of date and risky, but they won't change it).

I tried playing around with the .htaccess and rewrite everything under /api from https to http, but did not find a solution, the whole system goes into a redirect loop. I guess the problem lies between the htaccess redirect and the Magento internal redirection system.

Since this is a very specific problem, I did not really find a solution, even after googling for hours.

Can anybody give me pointers on what possibilities I have in order to achieve a complete https setup with just the API URLs unsecure?

Improve this question
3

Ok, didn't test this but should work. Since the API doesn't work on a store level (it uses 0) you could set the base urls to https on all websites but leave it as http on global scope.

Please find attached some amazing artwork that explains what I mean.

enter image description here

Improve this answer
1
  • 1
    That is actually a great idea. Played around with it and while it seems to work in principle it does something strange with the API: I set everything to http:// on global, but to https:// on store level. The store continues to work great on all https://. When trying to access the api on http:// it just redirects to the "root" website. When accessing on https://, it works. So while the idea works on some level, it fails in a new way on the API URL :(
    – Gerald
    Sep 9 '15 at 6:59
1

What comes close to your problem is SSL offloading, e.g. at load balancers. In those cases, the secure connection never reaches Magento itself and you need a way to tell the system that all is fine and there is no need to redirect.

This is what the System → Configuration → Web → Secure → Offloader header is available for.

So I suggest setting that server environment variable when the Request_URI matches the API resource path.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.