4

staging.website.com loads perfectly over https. However, https admin pages immediately break because the assets are trying to load over http. If I navigate to the https asset directly, it loads fine. It would seem that Craft is failing to recognize the https request and kick over to the https url.

Server Setup:

  • Cloudflare DNS / SSL
  • Arcustech VPS with Ubuntu & Apache

How I am enforcing HTTPS currently:

  • Cloudflare Page Rule (Always Use HTTPS)
  • Craft config: general.php > environmentVariables (siteUrl, baseCpUrl, etc.)

I do not have any https redirects going in my .htaccess - just the standard craft index.php logic. Adding https rules in the .htaccess will cause infinite loop redirects.

Improve this question
6
  • The type of Cloudflare SSL (full, flexible) matters, and a common problem is that Cloudflare offers https by querying your server at http URLs and sprucing them up. Your server is likely responding admirably, but may need encouragement to serve https URLs in this situation: gist.github.com/joshuabaker/bb45340bc4eda4c7d932
    – Matt Stein
    Mar 10, 2017 at 19:55
  • Thanks for the quick reply. So if I went the "SSL full" route, do you think I would completely sidestep the issue I'm having here? I tried that Gist and its still reporting back http in the admin.
    – Rjoss
    Mar 10, 2017 at 20:27
  • Probably not, and I honestly forget but assume Cloudflare's going to send the same headers (hints about SSL) either way. It might help to post your Craft config and detail your Cloudflare setup. You might also consider the Patrol plugin if you haven't already and just want to get on with your https control paneling.
    – Matt Stein
    Mar 10, 2017 at 21:58
  • general.php config, Cloudflare DNS, Cloudflare Page Rules
    – Rjoss
    Mar 10, 2017 at 22:49
  • I gave that Patrol plugin a shot - it definitely enforces https across the site. However, it seems to have no effect on the admin assets. In particular, Craft's admin css is trying to load a http font file: @font-face { font-family: 'Craft'; src: url("staging.website.com/admin/resources/fonts/…);
    – Rjoss
    Mar 10, 2017 at 23:06

3 Answers 3

Reset to default
5

The solution I came to was creating an Origin Certificate on Cloudflare, installing on it on my VPS, and setting the SSL setting to Full Strict. Now admin assets are loading perfectly over https. No .htaccess or Patrol plugin required.

If someone knows more about why this worked and the previous approach didn't I would love to hear your thoughts. Thanks @MattStein for clueing me towards this approach.

Improve this answer
1
  • Noting that this is also relevant for Craft 3
    – lealea
    Jun 27, 2018 at 5:09
1

It's probable that your Site URL in your website's config is using http rather than https. Setting it to https should force the control panel assets to load appropriately.

You can change this in Craft's Settings > System > General screen.

If you've overriden this in your website's config setting you'll instead need to update the siteUrl setting in that file. Documentation for this can be found here.

Improve this answer
1

Craft's default setting is 'resourceBaseUrl' => '@web/cpresources'. If your site or Docker Container runs http, Craft seems to (correctly) determine the http setup. This is why it ignores your siteUrl / ROOT_SITE_URL.

To fix this, either overwrite @web or manually set 'resourceBaseUrl'.

Set resourceBaseUrl

Explictly set 'resourceBaseUrl' => getenv('ROOT_SITE_URL') in config/general.php (assuming you ROOT_SITE_URL / siteUrl is set to something https://...)

Overwrite @web

Overwrite @web in config/general.php:

// Aliases for use in CP
'aliases' => [
    '@web' => getenv('ROOT_SITE_URL'),
]
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.