<HTML><BODY style="word-wrap: break-word; -khtml-nbsp-mode: space; -khtml-line-break: after-white-space; ">I had the same questions a year or so ago. Most of the time folks told me to change the base url to https, but that of course forces ssl across the entire Drupal site which isn't very efficient if you don't need ssl on the entire site.<DIV><BR class="khtml-block-placeholder"></DIV><DIV>A friend passed this code on to me and I am sorry to say I am not sure where it came from originally, but I have greatly benefited from it on my Drupal sites. Just replace the base url line in sites/default/settings.php with this code:</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV><B>$base_url = '<A href="http://localhost">http://localhost</A>';</B></DIV><DIV><B><BR class="khtml-block-placeholder"></B></DIV><DIV><B>if (!strcasecmp(substr($_SERVER['REQUEST_URI'],0,5),'/user') && !isset($_SERVER['HTTPS'])) {</B></DIV><DIV><B> header("Location: https://" . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']);</B></DIV><DIV><B> exit();</B></DIV><DIV><B>}</B></DIV><DIV><B>if (!strcasecmp(substr($_SERVER['REQUEST_URI'],0,5),'/user')) {</B></DIV><DIV><B> $protocol = "https";</B></DIV><DIV><B>}</B></DIV><DIV><B>else {</B></DIV><DIV><B> $protocol = "http";</B></DIV><DIV><B>}</B></DIV><DIV><B>$base_url = $protocol . "://yoursite.domain.com";</B></DIV><DIV><B><BR class="khtml-block-placeholder"></B></DIV><DIV>Make sure to change the list line to your web site base url. This code will force a redirect to an https session for requests to the /user are in Drupal which covers logins. Make sure to turn off the login block as this code does not protect the block. The cool thing about this bit of code is that it can be extended to redirect other areas of Drupal to https as needed.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>I hope this helps.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>Thanks!</DIV><DIV>Mark</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV><DIV><DIV>On Jun 12, 2006, at 3:46 AM, dondi_2006 wrote:</DIV><BR class="Apple-interchange-newline"><BLOCKQUOTE type="cite"><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">Greetings,</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; min-height: 14px; "><BR></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">I've just realized that (at least with default settings)</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">the admin section of a drupal website is accessible</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">via normal http, that is, I guess also the password</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">when I login is transmitted in plain text.</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; min-height: 14px; "><BR></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">How do I make sure that all admin pages and those only,</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">are sent via https, and that username and passwords are</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">sent encrypted from the browser?</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; min-height: 14px; "><BR></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">TIA,</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">O.</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; min-height: 14px; "><BR></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">--</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">[ Drupal support list | <A href="http://lists.drupal.org">http://lists.drupal.org</A>/ ]</DIV> </BLOCKQUOTE></DIV><BR></DIV></BODY></HTML>