Details
-
Type: Bug
-
Status: Done/Fixed
-
Priority: Minor
-
Resolution: Fixed/Completed
-
Affects Version/s: 3.0.1
-
Fix Version/s: 3.1
-
Component/s: Standalone CiviCRM
-
Labels:None
Description
Proxied SSL connections where SSL is terminated at a front-end server and the connection is proxied back to a PHP app server are not properly detected by CiviCRM. It assumes the connection is insecure because the one arriving on its server is. The community (mostly the Ruby on Rails guys) seems to be standardizing on sending the header below to the back-end servers when the original connection was secure:
X_FORWARDED_PROTO=https
CiviCRM used to look for a different header for this (something I added awhile back; or was at least sponsored by us), but it wasn't a standard, de facto or otherwise. And it appears it wasn't looking in the right place for it.
I'll be committing a fix for this shortly.