Securing a Single Page

I don’t have a way of testing this on my development server. How would I go about securing a single MODx document using a shared SSL certificate? So my website will be at something like: http://www.foo.com, but the entire site will also be accessible at something like: https://www.hostingco.com/~foo.

How would I ensure that for the secure page the WayFinder generated menu links to the non-secure pages?

Any pointers?

Thanks, Andy

Also it would be nice if web user login and signup pages could be secured individually.

Do you think it would be feasible to write a plugin to dynamically change the links on pages where needed? I’m guessing there is no support in MODx for this.

Andy

Not getting much response, so how about this? Is it possible to redirect access to a single page using .htaccess? So when a user accesses http://www.foo.com/login.html, it redirects to https://www.hostingco.com/~foo/login.html?

Would MODx still be able to render the page ok?

Andy

Quote from: ajayre at Oct 19, 2006, 03:09 PM

Not getting much response, so how about this? Is it possible to redirect access to a single page using .htaccess? So when a user accesses http://www.foo.com/login.html, it redirects to https://www.hostingco.com/~foo/login.html?

Would MODx still be able to render the page ok?

Andy

Use weblink, a perfect redirect! no need to go into .htaccess, and try by doing it, you will see the results faster! The path you are choosing is rather unusual (to use SSL) and I am not sure if anyone could reply.

I hope this helps.

regards.

zi

One problem you’ll run into is that a SESSION that is set up in the "HTTP" domain does not get used for the "HTTPS" domain and vice versa. For SESSION and COOKIE purposes, they are considered different domains.

Quote from: zi at Oct 20, 2006, 01:36 AM

Quote from: ajayre at Oct 19, 2006, 03:09 PM

Not getting much response, so how about this? Is it possible to redirect access to a single page using .htaccess? So when a user accesses http://www.foo.com/login.html, it redirects to https://www.hostingco.com/~foo/login.html?

Would MODx still be able to render the page ok?

Andy

Use weblink, a perfect redirect! no need to go into .htaccess, and try by doing it, you will see the results faster! The path you are choosing is rather unusual (to use SSL) and I am not sure if anyone could reply.

I hope this helps.

regards.

zi

Hi zi, I am thinking of the situation where login.html appears on the menu. Therefore WayFinder will automatically generate links to the page. I can’t use a weblink in that situation, right?

Andy

Quote from: sottwell at Oct 20, 2006, 03:51 AM

One problem you’ll run into is that a SESSION that is set up in the "HTTP" domain does not get used for the "HTTPS" domain and vice versa. For SESSION and COOKIE purposes, they are considered different domains.

I could write a plugin to ensure there are always two copies of the cookie info on each page load, right?

Andy

I’m a bit suprised there isn’t an easy solution for this. These days I think most web users expect website logins to use SSL, along with forms containing sensitive information. Don’t you agree? If there was some direction from the core coders on the best approach, I might have some time to implement and test the changes, as I really need this feature...

Andy

I think it would be really nice to add an option to documents to allow for SSL-only connections or not. (i.e. http or https)

ACLs and Sessions-handling are in the queue for repair post 095.