Hot answers tagged

17

Use _secure attribute. Ex: <img src="{{media url="wysiwyg/infortis/ultimo/menu/featured2.jpg" _secure="true" }}" />


16

The default answer is, set the unsecure base url to https:// depending on your setup this already is enough for a redirect if users try to use http:// Maybe a redirect on webserver level is better, as it avoids requests going through php first. And if you want the real perfectly secure solution, you should add your website on https://hstspreload.appspot....


14

ITS NOT THAT SIMPLE... There is a problem with changing the store unsecured url to https. Any links to existing pages, including links from ads, indexed pages in Google, etc, that point to http://yoursite.com/your_product.html will be redirected to https://yoursite.com/ You will need to go through your theme and make sure that there are no references to ...


13

Set your base url for both your secured and unsecured site to https://yoursite.com/. That's all you need to do.


9

Try This\ use Magento\Framework\App\Action\Action; use Magento\Framework\App\Action\Context; use Magento\Framework\HTTP\PhpEnvironment\RemoteAddress; class Index extends Action { private $remoteAddress; public function __construct( Context $context, RemoteAddress $remoteAddress ) { $this->remoteAddress = $...


7

There is no problem with HTTP/2 "just working". But there is opportunity for further optimization. My understanding is it is worth looking into capabilities of your CDN provider if you want to take full advantage of the push support. E.g. when request for first CSS etc file comes in, server can start pushing other files it knows you are almost certainly ...


6

Found the solution. Accessed the core_config_data table via phpMyAdmin, and removed the value of web/cookie/cookie_domain and set web/cookie/cookie_httponly to 0. Cleared the cache by removing the files in var/cache. Site's back up :)


6

https is only required on pages that submit data like the checkout page for example. Still, using a https URL for unsecure base url wouldn't hurt If you're worrying about people stealing cookies (session hijacking) go to System > Configuration > Web > Session Validation Settings and enable Validate REMOTE_ADDR [EDIT] - Credits to @AnnaVölkl so if ...


6

Just to close this out, a good friend of mine suggested I try this, and I am very pleased to say it worked. Perhaps it will help someone else who faces the same issue: In .htaccess file, add these lines: # Detect the ELB header and set the header magento expects SetEnvIf X-Forwarded-Proto https HTTPS=on


6

to force HTTPS, change your base url to https:// for unsecure too: bin/magento setup:store-config:set --base-url="https://myshop.com/" --base-url-secure="https://myshop.com/" --use-secure=1 --use-secure-admin=1 bin/magento cache:flush also if you have some redirect issues, you can add this to apache or .htaccess config: RewriteEngine On ...


5

My suggestion is, hold your horses. For example, if you are using Magento Enterprise Edition, HTTPS for the whole site will stop Magento’s Full Page Cache from working. We created a fix, for anyone to use - https://github.com/elastera/EnterprisePageCacheSSL (your feedback is greatly appreciated). Your Page Load time could be increased significantly, due to ...


5

Based on the hints by Simon, here is what I have: 1) Make sure "Auto-redirect to Base URL = No". It was set to "yes", and causing the problem. 2) Put the below in the .htaccess: RewriteCond %{HTTPS} off RewriteCond %{HTTP_HOST} !^www\.(.*)$ [NC] RewriteRule ^(.*)$ http://www.%{HTTP_HOST}/$1 [R=301,L] RewriteCond %{HTTPS} on RewriteCond %{HTTP_HOST} !...


5

The whole config is being loaded pretty early on in the app run and there are no events being dispatched related to this. I think the best way you could do this, is by hooking into the earliest event being dispatched, which would be controller_front_init_before (according to this). So you would need to write an event observer and in this observer you could ...


5

For anyone stumbling across this (like I did) Don't use htaccess. Under admin go Stores -> General -> Web and change -> Use Secure URLs on Storefront -> Yes and Use Secure URLs in Admin -> Yes There's no need to edit any files.


5

You can do it this way: @font-face { font-family: 'Open Sans'; font-style: normal; font-weight: 400; src: local('Open Sans'), local('OpenSans'), url(//fonts.gstatic.com/s/opensans/v10/cJZKeOuBrn4kERxqtaUH3VtXRa8TVwTICgirnJhmVJw.woff2) format('woff2'); } See src section. Instead of having font url with http put them this way: //fonts.gstatic.com/s/...


5

I assume you're not referring to Magento 2. For Magento 1.x, you can use Turpentine to let Magento work with Varnish. Fair warning, this is by no means a "plug and play" process! Varnish does not terminate SSL connections, so you're correct that it won't work by itself for HTTPS. You can however use something like nginx or pound to handle the terminate part ...


5

You need to edit your htaccess file for this kind of redirect. See below: ## enable rewrites Options +FollowSymLinks RewriteEngine on RewriteBase / RewriteCond %{HTTP_HOST} ^example.com$ [NC] RewriteRule ^(.*)$ https://www.example.com/$1 [R=301,L] RewriteCond %{HTTP_HOST} !^www\. [NC] RewriteRule ^(.*)$ https://www.%{HTTP_HOST}/$1 [R=301,L] RewriteCond %...


5

The issue was the Pound was only listening to 443 (https) and all HTTP was going straight to Varnish. Magento was supposed to be redirecting but sometimes Varnish would just send the HTTP version. The solution was to get Varnish itself to handle the http->https redirect. The way this was done is by editing the varnish vcl file as follows: sub vcl_recv { ...


4

I got it fixed now, i'll explain the process below... My admin panel was loading through HTTPS URL's due to our server configuration. However in the Magento Admin panel this option Config > General > Web Use Secure URLs in Admin was set to NO I knew changing this to Yes would probably fix all our admin panel issues. However changing it to yes and ...


4

you can do this with .htaccess in apache. Use these lines: ############################ Force SSL ############################ RewriteCond %{HTTP_HOST} !^localhost$ RewriteCond %{HTTP:X-Forwarded-Proto} =http RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301] ############################ Force SSL ############################


4

For this case, we can add new layout handler on basic of http/https at event controller_action_layout_load_before. Event: controller_action_layout_load_before Condition: Mage::app()->getRequest()->isSecure() is check page with https or http. So , i am start an observer on basic of this condition which is add new handler on current layout When ...


4

Final I found the solution. Replace the Base URL from http://example.com/ to //example.com/ CAUTION! The change is not allowed in magento2 admin. I made it in MySQL in table cron_config_data and record with path='web/unsecure/base_url'. After cache:clean and varnish restart everything works smoothly in frontend. Unfortunately problem remains in Backend. ...


4

If you're having issues with Magento not detecting the HTTPS redirect, you can add this to your the Magento .htaccess file located in your docroot: ############################################ ## Nginx proxy HTTPS Fix for Magento ## Source: https://www.sonassi.com/blog/magento-kb/magento-https-redirect-loop-2 SetEnvIf X-Forwarded-Proto https HTTPS=on See ...


4

Your VirtualHost configuration is basically correct. As you alluded to yourself, you will need to set the unsecurebaseurl (and securebaseurl) to be https. Magento uses the unsecure urls for basically everything it doesn't explicitly consider secure, however there is no reason why you can't have these pointing to https also. EDIT: The only other thing to ...


4

You definitely can use Http/2 with any version of Magento. And yes, you need to enable https for all pages (it's recommended setup for M2, why do you not did it before). Also, bundling of js files don't make sense with http2, so better to disable it


4

I'm pretty _secure only works if the URL natively supports HTTPS. In case it does not (which seems to be your case as your code is totally valid) you can force it using _forced_secure: $this->storeManager->getStore()->getUrl('someurl', ['_secure' => true, '_forced_secure' => true]); Also you were casting true to a string 'true' I'm not sure ...


4

You can do so by using the _secure parameter: <?php echo Mage::getUrl('productquestions/productquestions/saveanswers',array('product_questions_id'=>$id, '_secure' => true));?>


4

Open your core_config_data table in phpMyAdmin. Find the row with the path web/secure/use_in_adminhtml and change its value field from 1 to 0 to enable accessing admin panel from unsecure http://www.yourwebsite.com/admin url Changing web/secure/use_in_frontend toggles customer shopping cart security, 1=on and 0=off which probably isn't of importance as you'...


Only top voted, non community-wiki answers of a minimum length are eligible