Hi
I'm trying to get a drupal7 site setup on nginx with everything served via https, with http doing a global rewrite e.g.
server {
server_name mysite.fqdn;
listen :80;
rewrite ^/(.)$ https://mysite.fqdn/1ドル permanent;
}
Whilst this seems to work fine for the many drupal6 sites we have running on this host with drupal7 this results in the old "Your connection to mysite.fqdn is encrypted with 256-bit encryption. However, this page includes other resources which are not secure. These resources can be viewed by others while in transit and can be modified by an attacker to change the behaviour of the page." red X message in chrome and IE9's "only secure content is displayed" "show all content".
Having looked at the source in both browsers I believe the problem is the way that the css is included and a small experiment went some way to proving this.
In drupal 7 the css is included by way of e.g. @import url("http://mysite.fqdn/modules/system/system.menus.css")
In IE9 if we "show all content" the stylesheets are then pulled in (by way of being redirected to https). However if the http server on port 80 is stopped and "show all content" is pressed then the stylesheets are not pulled in (obviously!).
The same site on a apache2 server with a:
ServerName mysite.fqdn
Redirect permanent / https://mysite.fqdn/
shows the css includes as @import url("https://mysite.fqdn/modules/system/system.menus.css")
Does anyone have any ideas how apache is managing this? additionally we are not using securepages or session443 on either setup.
Thanks
Bails
Comments
Try this:
server {
server_name mysite.fqdn;
listen 80;
return 301 https://mysite.fqdn$request_uri;
}
Try it on the CLI with cURL. Any request for a
httpscheme should be redirected tohttps.Of course you need a properly configured SSL host. The above does only the redirect.
Hi Perusio Thanks for the tip
Hi Perusio
Thanks for the tip but using the 301 is still a no go. As I said above the ssl host is properly configured. If I swap the root to a drupal6 copy of the site in question it behaves exactly as I expect (no warnings and everything is served fine from https). Its just drupal7 that doesn't work as expected.
Hmm.
There seems to be something on the drupal side of things failing. Does this helps you in any way?
Is drupal writing the "links"
Is drupal writing the "links" to the css as "http://"?
This is what I use in settings.php for Drupal 6:
if (!empty($_SERVER['HTTPS'])) {$base_url = 'https://mysite.fqdn';
}
else {
$base_url = 'http://mysite.fqdn';
}
and see http://drupal.org/https-information for whether to $conf['https'].
Mo' better :)
No ifs:
<?php$base_url = empty($_SERVER['HTTPS']) ? 'http://mysite.fqdn' : 'https://mysite.fqdn';
?>
Hi peruso /
Hi peruso / brianmercer.
Thanks for the input. Looks like all I was missing was a:
$base_url = 'https://mysite.fqdn';
in settings.php as the site doesn't use http on any pages. Now all the css requests come from https://mysite.fqdn
Thanks again.
You shouldn't need $base_url
You shouldn't need $base_url in Drupal 7. Are you sure $_SERVER['HTTPS'] is getting set ton 'on' correctly?
Then make sure you're passing
Then make sure you're passing HTTPS to cgi with something like this:
location = /index.php {include /etc/nginx/fastcgi_params;
fastcgi_param SCRIPT_FILENAME $basepath/drupal/index.php;
fastcgi_param HTTPS $cgi_https;
fastcgi_pass php;
}
and this in your nginx.conf:
map $scheme $cgi_https {default '';
https on;
}
There's a built in https variable in one of the most recent dev versions of nginx, but the above should be safe for any non-ancient version.
If you're using
Nginx version >= 1.1.11 there's a
fastcgi_param HTTPS $https if_not_emptyflag that will set theHTTPSparam toonif the scheme ishttps.undefined index HTTPS
nginx/1.2.3, but when I try to access this, or dump out $_SERVER from settings.php, it isn't present. Also confirmed it is in nginx's fastcgi_params file. I'z confuzed.
--
matt j. sorenson, g.d.o., d.o.
fastcgi_params vs fastcgi_drupal.conf?
from fastcgi_params, I copied the line:
and pasted into fastcgi_drupal.conf, and that made HTTPS available to drupal
Near as I could tell, fastcgi_params was being loaded by nginx.conf... so I'm not clear on why this was necessary?
P.s. Drupal 7 and we started with @perusio's 'drupal-with-nginx' project.
--
matt j. sorenson, g.d.o., d.o.
It's worth noting that if
It's worth noting that if you're using boost, most boost configurations I've seen are stupid, and will happily server http cached pages to https users, with all the http links to css, js, images, etc intact...