Support/Comments for Encryption

Sorry
url_b was https://secure.myhosting.com/mysite/ViewRegistration.html
As it is a shared SSL hosting
it was secure
kishore

I’m not sure what the problem is. I’m sorry but I just don’t have the time right now to give it a try (big deadline at work). How about encrypting all the user’s pages? If you go from one encrypted page to another then no redirect is required by the Encryption snippet.

Andy

Hi,
my client has requested that registered web users can log in using SSL somewhere other than the actual ModX site. So here are a couple of questions related to that (as I’ve never had a need for SSL before)

• Can encryption do this
• Is there another way
• Is it going to be much more secure than normal?

Thanks for anything from anyone in the know!

Taff

SSL is SSL. Using SSL for a MODx page is just as secure as using SSL for a non-MODx page, so I don’t really understand the question.

The encryption snippet is a snippet - so it only works with MODx.

Sorry if I am misunderstanding...

Andy

Thanks again for your help Andy.

I was just putting out my feelers as I have never done anything like this.

My basic request is that the web users login page is somewhere other than the rest of ModX so that it is more secure than normal as some very sensitive data will be stored there.

Is this possible with the Encryption snippet or wold you recommend a different approach?

Thanks,
Taff

The encryption snippet allows you to pick and choose which MODx pages are encrypted using SSL. So you can have the page with the login form encrypted and the page the user is directed to after login also encrypted. You can do this with a dedicated SSL certificate or a shared SSL certificate.

SSL purely encrypts the data between you and the server, nothing else, and has nothing to do with the content.

If you want to take advantage of the web users feature of MODx then it doesn’t make sense to log users in outside of MODx.

Perhaps I am misunderstanding - do you want to "hide" the log in page from regular visitors to the site, but it is still a MODx generated page? If so then just create the login page and make sure no other pages link to it. Then search engines, etc. won’t find it.

Andy

No, you understood correctly, and have cleared up any questions I had.

Thanks again
Taff

I’ve been struggling getting this to work and my suspicion is that it’s the .htaccess file that is keeping it from working. I have a shared ssl cert that I’m trying to use and I’ve followed the directions for this snippet to a "T". I’ve even turned off furls to see if that was the problem and it still refuses to work.

Here’s the scenario:

I request my shared ssl url which is https://ssl21.servage.net/mysite.net/ and it keeps redirecting me back to http://www.thecountyedge.net/

In the .htaccess file, I put:

RewriteCond %{SERVER_PORT} 443
RewriteRule ^(.*) https://ssl21.servage.net/mysite.net/$1 [R=301,L]

and a variety of other combinations of the above, still no good. I either get an SSL connection to my hosts 404 page or I get nothing at all.

Any hints on how to get this working properly would be greatly appreciated. I’m no mod_rewrite guru.

I’ve attached my .htaccess file as well.

Thanks

Edit: Just wanted to mention that I have tried both htaccess methods listed here, and here. Just can’t get it to work properly.

Any ideas?

Quote from: derekm at Dec 20, 2007, 07:53 AM

Any ideas?

derekm:

Please don’t bump posts unless you are providing additional information that might assist people in advising you on your issue. Thanks.

As for your issues with the Encryption snippet, we’ll need to know more about your shared SSL url. Is this actually a separate location on your server, or does it give you access to the same physical resources as your normal domain? This will not work if the shared SSL domain is pointing at a separate resource directory (at least I don’t believe it can, without knowing more about it).