CODEWITHSUNDEEP
php.htaccessyii
Michael Dowers
Michael Dowers

Reputation: 41

Forcing https on one page causes mixed content

I am trying to force https only on one page of a yii framework website, and let the rest of the pages be http. The page that would be forced https is 

https://www.mywebsite.com/index.php?r=user/profile

The following creates what I desire, but with a mixed content error. Furthermore, when I go from the mixed content tab to any other tab, it doesn't automatically become http. It takes the movement to one more tab to reach http status. 

RewriteEngine On
# Go to https 
RewriteCond %{HTTPS} off
RewriteCond %{QUERY_STRING} ^r=user/profile$ [NC]
RewriteRule ^(index\.php)$ https://www.mywebsite.com/$1 [R,L]

# Go to http 
RewriteCond %{HTTPS} on
RewriteCond %{HTTP_REFERER} !/index\.php\?r=user/profile
RewriteCond %{REQUEST_URI} !^/index\.php$ [OR]
RewriteCond %{QUERY_STRING} !^r=user/profile$ [NC]
RewriteRule ^(.*)$ http://www.mywebsite.com/$1 [R,L]

The mixed content error is as follows. 

Mixed Content: The page at 'https://www.mywebsite.com/index.php?  r=user/profile' was loaded over HTTPS, but requested an insecure image 'http://www.mywebsite.com/assets/7a295fc1/nav1_bg.gif'. This content should also be served over HTTPS.

As it can be seen, the assets under yii framework is the only folder causing problem.

1.Is there a way to request the files used from assets in a https fashion so I don't get a mixed content error?

2.Is there a way to ensure that moving from the https tab to any other tab causes immediate http conversion, instead of requiring the movement to one another tab. (i.e. Profile page(https) to Home page causes a Home page with (https). Movement from the home page to any page other than the profile page becomes (http). I would like it to happen immediately.

Upvotes: 0

Views: 383

Answers (1)

sadlil
sadlil

Reputation: 3163

The problem is you cant make a http request for any static or dynamic files from an https connection.

The best solution is to Move entire thing in https.

If it is not possible then one other solution would be like this - make a proxy page. that would be receiving https request and fetch the content over http and serve it via https.

Upvotes: 2

Related Questions