Hot answers tagged

29

Thanks to a tip on the #magento-de irc channel I found a much more elegant solution. Add these lines to the end of your .htaccess and it should be fine: # Detect the Load-Balancer-Header and set the header magento expects SetEnvIf X-Forwarded-Proto https HTTPS=on Go here for a longer explanation.


18

The redirect to HTTPS root has nothing to do with the unsafe URL setting and the .htaccess setting suggested is not required. If you have issues when redirecting from http://yoursite.com/your_product.html to https://yoursite.com/ when using HTTPS, just go to: System -> Configuration -> General -> Web -> Redirect options And set: Auto-redirect to Base URL ...


17

Use _secure attribute. Ex: <img src="{{media url="wysiwyg/infortis/ultimo/menu/featured2.jpg" _secure="true" }}" />


16

You need to change. In the same tab check Offloader header value is SSL_OFFLOADED If you want to use ssl for all pages, then need to change Base unsecure Url


16

The default answer is, set the unsecure base url to https:// depending on your setup this already is enough for a redirect if users try to use http:// Maybe a redirect on webserver level is better, as it avoids requests going through php first. And if you want the real perfectly secure solution, you should add your website on https://hstspreload.appspot....


14

Actually Firefox stopped supporting Flash (http://www.computerworld.com/article/2948012/security/adobe-flash-must-die-firefox-facebook-itbwcw.html) Tobias Renger already made a no-flash uploader you get can from Github which works well. https://github.com/openstream/No-Flash-Image-Uploader


13

Set your base url for both your secured and unsecured site to https://yoursite.com/. That's all you need to do.


13

ITS NOT THAT SIMPLE... There is a problem with changing the store unsecured url to https. Any links to existing pages, including links from ads, indexed pages in Google, etc, that point to http://yoursite.com/your_product.html will be redirected to https://yoursite.com/ You will need to go through your theme and make sure that there are no references to ...


13

Yes it goes into the configuration file. If you look at core/Mage/Checkout/etc/config.xml you can see how Magento does it for the checkout: <frontend> <secure_url> <checkout_onepage>/checkout/onepage</checkout_onepage> <checkout_multishipping>/checkout/multishipping</checkout_multishipping> </...


10

first of all, this: <?php echo $this->getSkinUrl(); ?>images/Home.gif should be <?php echo $this->getSkinUrl('images/Home.gif'); ?> You can pass parameters to getUrl to make it secure: $this->getUrl('', array('_secure'=>true)); $this->getSkinUrl('images/Home.gif', array('_secure'=>true));


10

Your first attempt (with the {{media}} tag) is correct and should work. In the admin go to System > Configuration > Web > Secure and make sure the following are set: Base Link URL - {{secure_base_url}} Base Skin URL - {{secure_base_url}}skin/ Base Media URL - {{secure_base_url}}media/ Base Javascript URL - {{secure_base_url}}js/ This way all the paths ...


10

There seem to be quite a some confusion as a result of the email by PayPal. What they basically means is that PayPal IPN will only work with websites with SSL Certificates that are using 2048-bit and also SHA-256. 2048-bit should now be standardized for all SSL Certificates so it shouldn't be a problem. SHA-256 is something that you need to take note ...


10

You can use $isSecure = Mage::app()->getStore()->isCurrentlySecure(); or $isSecure = Mage::app()->getFrontController()->getRequest()->isSecure(); Source here.


9

You can use the _forced_secure option for this: Mage::getUrl('page_url_key', array('_forced_secure' => true)); See http://www.magentocommerce.com/wiki/5_-_modules_and_development/reference/geturl_function_parameters for all options that you can use with getUrl.


9

This question is not a black-and-white Q&A-style question. It will have no de-facto answer and will likely be closed. However, I have extremely strong opinions on the matter, which I have detailed below. Hopefully I've understood your question. Here are a few concerns of mine: You underestimate the consumer. Today online shoppers are educated. They're ...


8

You can use below as another solution: if (Mage::app()->getStore()->isFrontUrlSecure() && Mage::app()->getRequest()->isSecure() ) { // current page is https }else { // current page is http }


7

Check out this answer on stackoverflow on setting the header in your htaccces. This will ensure the header is properly set on every request from your domain: Try this in the .htaccess of the external root folder : <IfModule mod_headers.c> Header set Access-Control-Allow-Origin "*" </IfModule> And if it only concerns .js scripts you ...


6

The Flash Upload doesn't handle invalid or self-signed certificates. It just throws an error, therefore you have two possibilites: Create a certificate and make sure it is trusted in your system (don't ask me how!) Just remove the https from the url and use http on your local dev system (the url can be changed in the backend: System > Config > Web >...


6

Your browser is probably blocking un-secure content Some versions of recent browsers (FireFox/Chrome) will reject HTTP content when the page is served over HTTPS. This is to prevent insecure content being served alongside secure content. So if you visit the homepage in Magento and specify https:// in the URL, all the linked resources within the page source ...


6

So I got a semi-official answer from Piotr on Twitter: https://twitter.com/piotrekkaminski/status/559784661602144256?cn=cmVwbHk%3D It's fixed from 1.14.1. "@airbone42 @bobbyshaw not sure.coming from old times, when https was only personal, non cacheable pages"


6

Yeah Surely you can do that, just edit the following entries of your magentoroot/app/etc/local.xml file like this: <connection> <host><![CDATA[myinstance.amazonaws.com:3306]]></host> <username><![CDATA[yourDBusername]]></username> <password><![CDATA[yourDBpassword]]></password> <...


6

It sounds like Magento's severely tightened up their HTTPS on the repo.magento.com server. These settings are tight enough that applications that support HTTPS but use an older version of OpenSSL may have their connections rejected. Meaning, if the version of PHP you're using to run composer.phar is linked against and older version of PHP, you'll get ...


5

Enable Frontend SSL. SSL urls are used by default for only certain areas (like checkout and login) in Magento. All that is required is to fill in the SSL url fields of System > Configuration > Web > Secure: Make sure to Enable the option for Frontend SSL. A well-configured theme will have url links back to the CMS portion of Magento that break ...


5

Are you sure that the "trust" is bound to SSL certification here and not just to fact that checkout might be confusing and your clients only go to the checkout to get to know/see the full price with shipping and taxes? You have installed the certificate but have you checked if everything on checkout page is over ssl and you don't get the security warnings ...


5

This happens because we run both Apache and NginX on our servers to give you maximum performance. Apache handles the PHP code while NginX is used to serve static content such as images and javascript faster than Apache can. To install Magento enable "Skip Base URL Validation Before the Next Step" in the installation and your install should proceed without ...


5

You have to use _type => 'direct_link' Mage::getUrl('page_url_key', array( '_nosid' => true, '_store' => 'default', '_type' => 'direct_link' ));


5

My suggestion is, hold your horses. For example, if you are using Magento Enterprise Edition, HTTPS for the whole site will stop Magento’s Full Page Cache from working. We created a fix, for anyone to use - https://github.com/elastera/EnterprisePageCacheSSL (your feedback is greatly appreciated). Your Page Load time could be increased significantly, due to ...


5

The whole config is being loaded pretty early on in the app run and there are no events being dispatched related to this. I think the best way you could do this, is by hooking into the earliest event being dispatched, which would be controller_front_init_before (according to this). So you would need to write an event observer and in this observer you could ...


4

The only thing you need to do to configure Magento for SSL is setting the Secure Base URL to use https instead of http under System > Configuration > General - Web > Secure. So starting off with or without an SSL certificate doesn't really matter from a technical Magento point of view. However, a small sidenote: I've come across a few (Dutch) ...


Only top voted, non community-wiki answers of a minimum length are eligible