| Author |
|
gijs
Joined: 27 Apr 2012
Posts: 189
Location: The Netherlands
|
 Posted: Fri 06 Mar '15 19:03 Post subject: Apachelounge not using HTTPS |
 |
|
I just noticed that this website doesn't use HTTPS when logging in on the forum by default.. 
It does support HTTPS but only when turned on manually by adding https://
I suggest the URL to the login page is edited to protect our passwords. (for example from man in the middle attacks on public WiFi networks) |
|
| Back to top |
|
James Blond
Moderator
Joined: 19 Jan 2006
Posts: 7371
Location: Germany, Next to Hamburg
|
| Posted: Mon 16 Mar '15 12:25 Post subject: |
|
|
Steffen could add the following code to login.php file
| Code: | if($_SERVER['HTTPS'] != "on"){
$redirect = "https://". $_SERVER['HTTP_HOST']. $_SERVER['REQUEST_URI'];
header("Location: $redirect");
die();
} |
|
|
| Back to top |
|
ng4win
Joined: 25 May 2014
Posts: 78
|
| Posted: Mon 16 Mar '15 13:47 Post subject: |
|
|
| It also defaults back to http no matter if you force https, sounds like a default setting is rewriting back to http. |
|
| Back to top |
|
admin
Site Admin
Joined: 15 Oct 2005
Posts: 692
|
| Posted: Mon 16 Mar '15 15:52 Post subject: |
|
|
| @James Your snippet gives: This webpage has a redirect loop. |
|
| Back to top |
|
James Blond
Moderator
Joined: 19 Jan 2006
Posts: 7371
Location: Germany, Next to Hamburg
|
| Posted: Mon 16 Mar '15 17:30 Post subject: |
|
|
| I wonder cause this works on all my webpages. Maybe you can force SSL for login.php by mod rewrite |
|
| Back to top |
|
Steffen
Moderator
Joined: 15 Oct 2005
Posts: 3092
Location: Hilversum, NL, EU
|
| Posted: Tue 25 Aug '15 11:46 Post subject: |
|
|
Made some changes, now with logging in it changes to https.
Hope all the rest still works fine. Please check. |
|
| Back to top |
|
gijs
Joined: 27 Apr 2012
Posts: 189
Location: The Netherlands
|
| Posted: Tue 25 Aug '15 13:40 Post subject: |
|
|
| After login it changes to https, but especially the login page itself should be protected (since that is the page where our passwords are being send, currently unencrypted) |
|
| Back to top |
|
Steffen
Moderator
Joined: 15 Oct 2005
Posts: 3092
Location: Hilversum, NL, EU
|
| Posted: Tue 25 Aug '15 13:52 Post subject: |
|
|
Thanks for checking.
Should now be ok, login link now https. |
|
| Back to top |
|
gijs
Joined: 27 Apr 2012
Posts: 189
Location: The Netherlands
|
| Posted: Tue 25 Aug '15 13:56 Post subject: |
|
|
Perfect, all seems well.  |
|
| Back to top |
|
