Skip to main content

This site requires you to update your browser. Your browsing experience maybe affected by not having the most up to date version.

General Questions

General questions about getting started with SilverStripe that don't fit in any of the categories above.

Moderators: martimiz, Sean, biapar, Willr, Ingo, swaiba, simon_w

securing admin and security sections with ssl


Reply

2 Posts   448 Views

Avatar
flare

24 September 2013 at 11:28am Community Member, 1 Post

Hi I'm running silverstripe 2.4.5, can anyone point me to any documentation on how I get these areas protected by SSL?

Currently in _config.php

I have

Director :: set_environment_type ('live');

//force SSL
$force_ssl = array("/admin/","/Security/");
$current_url = $_SERVER['REQUEST_URI'];
if (in_array($current_url,$force_ssl)) {
Director::forceSSL();
} elseif ( isset($_SERVER['SSL']) || (isset($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) == 'on')) {
$destURL = str_replace('https','http', Director::absoluteURL($_SERVER['REQUEST_URI']));
header("Location: $destURL", true, 301);
die('<h1>Your browser is not accepting header redirects</h1><p>Please <a href="'.$destURL.'">click here</a>');
}

But this seems to do some of the job but gets into redirection loops and also does not protect the form the credentials are sent to.

Thanks

Avatar
Willr

28 September 2013 at 5:31pm Forum Moderator, 5511 Posts

You can pass the URL's you want to protect to forceSSL

if(Director::isLive()) Director::forceSSL(array('/^admin/', '/^Security/'));