1

I am using the Drupal Secure Pages module to secure sensitive pages (such as login and admin pages). I am running into two issues with this:

  1. I am able to login securely on the login page using https. However when I traverse to a non-secure page such as the home page, the browser completely forgets that I am logged in (instead of my username, the login link shows up). (The problem goes away as soon as I disable the Secure Pages module.)

  2. Since the secure pages are getting their images using non-secure URLs, the browsers are showing warning messages. For example, "The site uses SSL, but Google Chrome has detected insecure content on the page."

  • Is there any clean solution to these issues?
  • The recommendation here was to make the entire site secure, which seems like an overkill for my site (essentially an open source community). Having said that, how much of a performance hit does something like this incur, roughly?

Thanks.

Community
  • 1
  • 1
Naresh
  • 23,937
  • 33
  • 132
  • 204

1 Answers1

0

I was able to solve the issue with non-secure pages not remembering the login state. The solution was to add this line to sites/default/settings.php: $conf['https'] = TRUE; You can see the details here.

As far as I can tell, issue #2 was a browser caching issue. I cleared all the caches and cookies and the problem seems to have gone away!

Naresh
  • 23,937
  • 33
  • 132
  • 204