Thank you for your replies Pierre and Michael. This is becoming a good discussion for all.
For those who are tuning in. I have configured the site to use ssl, but the posts are being sent in plain. Does someone want to share a success story?
In reply to Pierre: The posts are always sent in the clear, not intermitently but I will look at the cache.
I am using the domain access module so I haven't set the base-url in settings.php. So I using relative urls always and not relative urls, at least that's what I think is happening.
Pierre have you configured their drupal with ssl just within apache configs using mod ssl and mod rewrite?
In reply to Michael: I activated the secure pages module (again leaving the base url blank, based on reading the module's code) this should rewrite the url with https in front for paths in the secure module lists. But after all this, posts were still sent in the clear.
Michael if securepages is working for you, perhaps I did something in apache configs to conflict with this module? Like could this be something to do with mod_rewrite or apache configs? I am rewiting my urls for clean-urls.
On 5/16/09, Michael Prasuhn mike@mikeyp.net wrote:
The problem comes when Drupal can't tell which is the 'base_url' that should be used for form_actions and URLs.
Check out the secure_pages module, it handles the switching and sets the necessary variables for various pages of the site. It also will redirect to secure or non-secure if necessary for your site.
-Mike
On May 16, 2009, at 2:39 PM, Joseph Yamada wrote:
... this is bad, I won't be able to deploy to production until I fix this.
I've configured mod_ssl with my apache to require my drupal site to run in SSL.
And then I changed my login form to post back in https all the time $form = array( '#action' => preg_replace('/^http:/', 'https:', url($_GET['q'], drupal_get_destination(), null, true)), );
So my logins are encrypted.
So I'm on the site and https is encrypting the GETs, but then I change a form, say my profile page, then I post anything back to the server and my browser says I am sending text in the clear, non- encrypted.
Does this mean I need to rewrite the form posts for every form post page ?
Has anyone seen this, please assist a fellow Drupal user,
-- [ Drupal support list | http://lists.drupal.org/ ]
Michael Prasuhn 503.488.5433 office 714.356.0168 cell 503.661.7574 home mike@mikeyp.net http://mikeyp.net
-- [ Drupal support list | http://lists.drupal.org/ ]