SSL behind load balancer
Reported by Gene Redinger | June 6th, 2016 @ 07:11 PM | in 2.3.9 (closed)
It seems that exponent-cms doesn't recognize when a user accesses the site through a load balancer that does SSL termination.
This file:
exponent-cms/exponent_constants.php
This code:
/** * URL_BASE Constant * * The URL_BASE constant is the base
URL of the domain hosting the Exponent site. * It does not include
the PATH_RELATIVE information. The automatic * detection code can
figure out if the server is running in SSL mode or not */ if
(!defined('URL_BASE')) {
define('URL_BASE', ((isset($_SERVER['HTTPS']) &&
$_SERVER['HTTPS'] == 'on') ? 'https://' : 'http://') . HOSTNAME); }
Should make another server check:
$_SERVER['HTTP_X_FORWARDED_PROTO'] should return http or https
Comments and changes to this ticket
-
expNinja June 7th, 2016 @ 03:00 AM
- State changed from “new” to “resolved”
(from [4e8165c6c3dbf9938c9bfe6c67dfabbbd98dc6c6]) update URL_BASE constant to account for ssl load balancer [#1367 state:resolved] https://github.com/exponentcms/exponent-cms/commit/4e8165c6c3dbf993...
Please Sign in or create a free account to add a new ticket.
With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.
Create new ticket
Create your profile
Help contribute to this project by taking a few moments to create your personal profile. Create your profile ยป
Bug Tracker for Exponent CMS
expNinja