The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Hot answers tagged

17

Use _secure attribute. Ex: <img src="{{media url="wysiwyg/infortis/ultimo/menu/featured2.jpg" _secure="true" }}" />


16

The default answer is, set the unsecure base url to https:// depending on your setup this already is enough for a redirect if users try to use http:// Maybe a redirect on webserver level is better, as it avoids requests going through php first. And if you want the real perfectly secure solution, you should add your website on https://hstspreload.appspot....


14

ITS NOT THAT SIMPLE... There is a problem with changing the store unsecured url to https. Any links to existing pages, including links from ads, indexed pages in Google, etc, that point to http://yoursite.com/your_product.html will be redirected to https://yoursite.com/ You will need to go through your theme and make sure that there are no references to ...


13

Set your base url for both your secured and unsecured site to https://yoursite.com/. That's all you need to do.


10

Your first attempt (with the {{media}} tag) is correct and should work. In the admin go to System > Configuration > Web > Secure and make sure the following are set: Base Link URL - {{secure_base_url}} Base Skin URL - {{secure_base_url}}skin/ Base Media URL - {{secure_base_url}}media/ Base Javascript URL - {{secure_base_url}}js/ This way all the paths ...


9

You can use the _forced_secure option for this: Mage::getUrl('page_url_key', array('_forced_secure' => true)); See http://www.magentocommerce.com/wiki/5_-_modules_and_development/reference/geturl_function_parameters for all options that you can use with getUrl.


6

The https redirection does not work for cms pages because the Router that matches the cms pages (Mage_Cms_Controller_Router) does not check if some page should be secure. Here is a little workaround to achieve this. It involves changing the router for the cms pages. You will have to create a module. Let's call it Easylife_Secure: For this you will need the ...


6

Your browser is probably blocking un-secure content Some versions of recent browsers (FireFox/Chrome) will reject HTTP content when the page is served over HTTPS. This is to prevent insecure content being served alongside secure content. So if you visit the homepage in Magento and specify https:// in the URL, all the linked resources within the page source ...


6

Found the solution. Accessed the core_config_data table via phpMyAdmin, and removed the value of web/cookie/cookie_domain and set web/cookie/cookie_httponly to 0. Cleared the cache by removing the files in var/cache. Site's back up :)


6

https is only required on pages that submit data like the checkout page for example. Still, using a https URL for unsecure base url wouldn't hurt If you're worrying about people stealing cookies (session hijacking) go to System > Configuration > Web > Session Validation Settings and enable Validate REMOTE_ADDR [EDIT] - Credits to @AnnaVölkl so if ...


6

There is no problem with HTTP/2 "just working". But there is opportunity for further optimization. My understanding is it is worth looking into capabilities of your CDN provider if you want to take full advantage of the push support. E.g. when request for first CSS etc file comes in, server can start pushing other files it knows you are almost certainly ...


6

You need to edit your htaccess file for this kind of redirect. See below: ## enable rewrites Options +FollowSymLinks RewriteEngine on RewriteBase / RewriteCond %{HTTP_HOST} ^example.com$ [NC] RewriteRule ^(.*)$ https://www.example.com/$1 [R=301,L] RewriteCond %{HTTP_HOST} !^www\. [NC] RewriteRule ^(.*)$ https://www.%{HTTP_HOST}/$1 [R=301,L] RewriteCond %...


5

You have to use _type => 'direct_link' Mage::getUrl('page_url_key', array( '_nosid' => true, '_store' => 'default', '_type' => 'direct_link' ));


5

Having Magento always match the protocol which the user is currently on would cause problems, such as not spitting out secure URLs to the customer login page when on a non-secured URL like the home page of the site. What I would suggest doing is adding some configuration XML to a custom module's config file to declare the additional routes you need to be ...


5

My suggestion is, hold your horses. For example, if you are using Magento Enterprise Edition, HTTPS for the whole site will stop Magento’s Full Page Cache from working. We created a fix, for anyone to use - https://github.com/elastera/EnterprisePageCacheSSL (your feedback is greatly appreciated). Your Page Load time could be increased significantly, due to ...


5

Based on the hints by Simon, here is what I have: 1) Make sure "Auto-redirect to Base URL = No". It was set to "yes", and causing the problem. 2) Put the below in the .htaccess: RewriteCond %{HTTPS} off RewriteCond %{HTTP_HOST} !^www\.(.*)$ [NC] RewriteRule ^(.*)$ http://www.%{HTTP_HOST}/$1 [R=301,L] RewriteCond %{HTTPS} on RewriteCond %{HTTP_HOST} !...


5

I got it fixed now, i'll explain the process below... My admin panel was loading through HTTPS URL's due to our server configuration. However in the Magento Admin panel this option Config > General > Web Use Secure URLs in Admin was set to NO I knew changing this to Yes would probably fix all our admin panel issues. However changing it to yes and ...


5

The whole config is being loaded pretty early on in the app run and there are no events being dispatched related to this. I think the best way you could do this, is by hooking into the earliest event being dispatched, which would be controller_front_init_before (according to this). So you would need to write an event observer and in this observer you could ...


5

You can do it this way: @font-face { font-family: 'Open Sans'; font-style: normal; font-weight: 400; src: local('Open Sans'), local('OpenSans'), url(//fonts.gstatic.com/s/opensans/v10/cJZKeOuBrn4kERxqtaUH3VtXRa8TVwTICgirnJhmVJw.woff2) format('woff2'); } See src section. Instead of having font url with http put them this way: //fonts.gstatic.com/s/...


5

I assume you're not referring to Magento 2. For Magento 1.x, you can use Turpentine to let Magento work with Varnish. Fair warning, this is by no means a "plug and play" process! Varnish does not terminate SSL connections, so you're correct that it won't work by itself for HTTPS. You can however use something like nginx or pound to handle the terminate part ...


4

you can do this with .htaccess in apache. Use these lines: ############################ Force SSL ############################ RewriteCond %{HTTP_HOST} !^localhost$ RewriteCond %{HTTP:X-Forwarded-Proto} =http RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301] ############################ Force SSL ############################


4

For anyone stumbling across this (like I did) Don't use htaccess. Under admin go Stores -> General -> Web and change -> Use Secure URLs on Storefront -> Yes and Use Secure URLs in Admin -> Yes There's no need to edit any files.


4

For this case, we can add new layout handler on basic of http/https at event controller_action_layout_load_before. Event: controller_action_layout_load_before Condition: Mage::app()->getRequest()->isSecure() is check page with https or http. So , i am start an observer on basic of this condition which is add new handler on current layout When ...


4

If you're having issues with Magento not detecting the HTTPS redirect, you can add this to your the Magento .htaccess file located in your docroot: ############################################ ## Nginx proxy HTTPS Fix for Magento ## Source: https://www.sonassi.com/blog/magento-kb/magento-https-redirect-loop-2 SetEnvIf X-Forwarded-Proto https HTTPS=on See ...


4

Your VirtualHost configuration is basically correct. As you alluded to yourself, you will need to set the unsecurebaseurl (and securebaseurl) to be https. Magento uses the unsecure urls for basically everything it doesn't explicitly consider secure, however there is no reason why you can't have these pointing to https also. EDIT: The only other thing to ...


4

You definitely can use Http/2 with any version of Magento. And yes, you need to enable https for all pages (it's recommended setup for M2, why do you not did it before). Also, bundling of js files don't make sense with http2, so better to disable it


4

I'm pretty _secure only works if the URL natively supports HTTPS. In case it does not (which seems to be your case as your code is totally valid) you can force it using _forced_secure: $this->storeManager->getStore()->getUrl('someurl', ['_secure' => true, '_forced_secure' => true]); Also you were casting true to a string 'true' I'm not sure ...


4

You can do so by using the _secure parameter: <?php echo Mage::getUrl('productquestions/productquestions/saveanswers',array('product_questions_id'=>$id, '_secure' => true));?>


Only top voted, non community-wiki answers of a minimum length are eligible