Support/Comments for Encryption

The hosting company I tested the snippet with uses seperate folders - public_html and secure_html. I simply deleted secure_html and create a soft link called secure_html that pointed to public_html. However I used the shell to do that. Not sure if it can be done via FTP.

Andy

Quote from: OpenGeek at Dec 20, 2007, 12:35 PM

Please don’t bump posts unless you are providing additional information that might assist people in advising you on your issue. Thanks.

Sorry, won’t happen again.
Quote from: OpenGeek at Dec 20, 2007, 12:35 PM

As for your issues with the Encryption snippet, we’ll need to know more about your shared SSL url. Is this actually a separate location on your server, or does it give you access to the same physical resources as your normal domain? This will not work if the shared SSL domain is pointing at a separate resource directory (at least I don’t believe it can, without knowing more about it).

The shared SSL url is not a separate resource, it’s not a location that contains any files or folders that I can physically access. It’s like a mirror of my domain, if you understand what I’m saying?

I wrote this snippet, and my opinion now is that it’s just easier to get your own certificate from someone like GoDaddy ($15 a year) and have the hosting company install it.

More and more it seems that hosting companies are self-signing their own certificates, which results in security warnings when you use it.

Andy

Your right, Andy. I went ahead and bought an SSL certificate for the domain. I had no idea that they were that cheap now.

Thanks!

Hello,

I have a question about this snippet (before I try it) - but first some background information:

This client’s site uses a template with a base url of http://www.sitename.com/, and I wanted just one page to have SSL, so I made that page with the same template, except with https://www.sitename.com/ as the base url. It works fine if you go directly to that page by typing in the URL, but if you get to that page through a link from a non-SSL page, it loads a version of this page which is non-SSL, and that’s not good, because this page is supposed to take credit card information in a form.

I wouldn’t mind just making the whole site SSL, but I am having a lot of trouble with that, because I can’t get every single element to load from a secure location, so every time a user goes to the page, they get an alert that says, "This page contains both secure and nonsecure items," and that gets annoying after a while.

Would this snippet cause the one page to always load the https version?

I guess if I have to, it’s no big deal to make links to this particular page absolute - except in the main navigation, which uses wayfinder. I wonder if there’s a way to override a relative link in the wayfinder menu and make it absolute? Guess that’s a question for the wayfinder thread. Just thinking "out loud" so to speak.

Yes, it will allow a single page to use SSL. It redirects to the HTTPS URL when the page is accessed.

Andy

I will definitely have a use for this snippet soon, a non SSL MODx website with a secure payment form... thanks for sharing this code !

I’ll report with my own experience, on a dedicated server with an IP installed by my host...

I finally got down to do some testing...

The snippet works as advertised

I need more info about the custom htaccess posted for the snippet :

[tt]RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ index.php?q=$1 [L,QSA]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{SERVER_PORT} 443
RewriteRule ^(.*)$ ~foo/index.php?q=$1 [L,QSA][/tt]

Which indicates that I am supposed to use different "folders" for http and https...
Might be a problem, since my intent is to have both http and https pages on the same domain : is that doable or not ?

Edit : Solved ! thanks to GaneshXL -> see this thread : http://modxcms.com/forums/index.php/topic,24052.msg148040.html#msg148040 and the defineBaseHref snippet

Is it possible please for more explanation for setting up SSL pages on the same server and in the same directory too please. I’m getting some weird URL rewrites when linking between SSL pages and non SSL pages eg: http://www.mysite.com/privacy.html?q=privacy.html. Have examined the above post without any insights.

Have set Encrypt up as a TV.

Checkout pages are tick as having ssl "on"


Have the following configured in the snippet:
$secureserver = "https://www.mysite.com";
$unsecureserver = "http://www.mysite.com";

And have the .htaccess code to work with the above.


RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ http://www.mysite.com/index.php?q=$1 [L,QSA]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{SERVER_PORT} 443
RewriteRule ^(.*)$ https://www.mysite.com/index.php?q=$1 [L,QSA]

If I type in the url of a page I know is set to ssl:

http://www.mysite.com/checkout-step-1.html

I can see the base url is https but why doesn’t the url rewrite to display https? Have tried using with friendly url alias paths turned on and modrewrite configured to:

RewriteRule ^(.*)$ https://www.mysite.com/checkout/index.php?q=$1 [L,QSA]

but get server errors and friendly url paths look even stranger:
http://www.mysite.com/checkout-step-1.html?q=checkout/checkout-step-1.html

My main point in the other forum was that the whole special .htaccess stuff isn’t needed at all.