ExpressionEngine access via both http and https

Question

We have an ExpressionEngine site we’re accessing via both http and https. Our users get security warnings from IE when accessing via https because some assets are accessed insecurely (CSS and images referenced there, in this case).

This happens when the setting ‘General Config -> URL to the root directory of your site’ includes the http:// protocol identifier (With that field blank, set just to the site domain [example.com], or set without a protocol [//example.com/], we encounter other problems, so those are not really an option). The problematic URLs are, of course, those generated with {path=} or {stylesheet=} in the templates.

Is there a good way to get all assets delivered via the same protocol as the page?

Thanks, Scott

Answer 1

It's because EE variables don't detect or utilise https by default, so you have to set them in code. The easiest way is to use an add-on:

http://devot-ee.com/add-ons/https-support

http://devot-ee.com/add-ons/dm-force-ssl

http://devot-ee.com/add-ons/force-ssl (commercial)

(In no particular order) I've not used any of these so can't recommend a specific one as I use my own plugin.

Answer 2

You can detect the protocol with PHP and set it dynamically in your system/expressionengine/config/config.php file. I use something like this:

$protocol = (isset($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] == "on") ? "https://" : "http://";
$base_url = $protocol . $_SERVER['HTTP_HOST'];

$config['base_url'] = $base_url . "/";

You can build your theme paths, various image paths, upload paths, etc all from that basis in config.php. But $config['site_url'] is what affects the output of {path=""} and {stylesheet} tags.

For more information, see NSM's Config Bootstrap file or the article Configuring ExpressionEngine for multiple servers. For all the paths you can set in config.php, see EE2 Config Overrides

Answer 3

Do you need to include the root URL? Often times I'll set the root URL of a site to just '/'.

Another option would be to manually include those assets (not using path or style helpers).

If a URL is realtive it will automatically inherit the current protocol.