Hot answers tagged

12 votes

How to set up {siteUrl} to work with both http and https

One method is using something like the following in your general.php file. Using this method the config settings will take on the scheme of the request being made. I've set both the siteUrl and ...
user avatar
  • 13.3k
6 votes

How to set up {siteUrl} to work with both http and https

Try setting it as the actual siteUrl config setting, rather than a siteUrl environment variable. See here for an explanation.
user avatar
  • 66.5k
5 votes
Accepted

Craft Admin assets do not load over https (Apache & Cloudflare)

The solution I came to was creating an Origin Certificate on Cloudflare, installing on it on my VPS, and setting the SSL setting to Full Strict. Now admin assets are loading perfectly over https. No ....
user avatar
  • 136
5 votes
Accepted

cp login over https gives error

This could be a couple things: Server config .htaccess file SSL Certificate But it sounds to me like the insecure login button means those assets are not being served over SSL. How'd you confirm the ...
user avatar
  • 6,477
5 votes

How to set up {siteUrl} to work with both http and https

I've already answered this question but ran into another situation that I feel merits a separate answer instead of making my first answer more complicated. In some cases, we use Cloudflare Flexible ...
user avatar
  • 13.3k
5 votes

Use Dukt Videos with HTTPS

Sorry about that guys, this issue has been fixed in Videos 1.0.20: https://dukt.net/craft/videos/updates#v1.0.20
user avatar
4 votes
Accepted

How can I redirect HTTP to HTTPS with a local self assigned SSL certificate in my .htaccess?

The condition should be: RewriteCond %{HTTPS} !=on (You were missing the = sign.) For more info, see our help article, How do I force SSL for CP requests?
user avatar
4 votes

From a Twig template, how to retrieve the content of a HTTP header in the current request?

By checking the code, I could find a method named getHeaders() that will return all the headers of the current request. So if you want to retrieve the content of the foo header, just use: {% set ...
user avatar
  • 496
4 votes

.dev local development

This seems missing from the other answers, so I feel the need to emphasize it here... Craft does not require .dev for local development. Your local URL can be anything you want, Craft does not care. ...
user avatar
  • 23.6k
3 votes
Accepted

When redirecting to HTTPS from www, index.php appears in URL

There are docs for removing index.php from your URLs here: https://craftcms.com/support/remove-index.php There are also docs for enforcing SSL for all CP requests here: https://craftcms.com/support/...
user avatar
  • 66.5k
3 votes

.dev local development

Yea Google bought .dev a few years back and now chrome forces https on all .dev domains. I switched to using .test which has been reserved. So far, so good. https://medium.engineering/use-a-dev-...
user avatar
3 votes
Accepted

Problem with Site Running Both HTTP & HTTPs

What web server are you running? I ask because IIS will define the $_SERVER['https'] variable even if the site is being accessed via HTTP (it's value will be 'off') and Ben's answer is only checking ...
user avatar
  • 115
3 votes
Accepted

Read POSTed JSON data from the request body

Yes, you can use getRestParams() like so: $input = craft()->request->getRestParams() A bit confusing naming there, which is why it's changing to getBodyParams() in Yii 2.
user avatar
  • 2,957
3 votes
Accepted

Using Twig's replace filter with getURL()

Try using: {{ gist.gistImage.first().getUrl('gistUnit')|replace({'http': 'https'}) }}
user avatar
  • 66.5k
3 votes
Accepted

Craft 3 Admin not loading cpresources files over HTTPS

The fix was to delete the content of the /cpresources folder and that did the trick.
user avatar
  • 631
2 votes
Accepted

Use Dukt Videos with HTTPS

We've run into this as well. I don't know if there is a better fix, but for our case, we ended up using the video url parameter and the replace filter to get around it: {% if entry.video|length %} &...
user avatar
  • 13.3k
2 votes
Accepted

Cache HTTP and HTTPS seperately using {% cache %}

I've never done this, but you should be able to use the cache using key parameter with the craft.request.isSecure property to do this. isSecure Whether the current request is over SSL. ...
user avatar
2 votes

Cache HTTP and HTTPS seperately using {% cache %}

Something like this would work: {% if craft.request.isSecure() %} {% set cacheKey = 'secure' %} {% else %} {% set cacheKey = 'insecure' %} {% endif %} {% cache using key cacheKey %} ... {...
user avatar
  • 66.5k
2 votes

Login - Bad Request: The CSRF token could not be verified

Once the same problem happened for me because of server caching and it may happen because of client-side cookie/cache. Sometimes, server caching will cache the entire form including CSRF token. So if ...
user avatar
  • 121
2 votes

Login - Bad Request: The CSRF token could not be verified

I have exactly the same issue, clearing cookies worked for me
user avatar
  • 21
2 votes

transfer to HTTPS

Change your site url in your config file. Add a 301 redirect to your htaccess to send requests for http to https. # Redirect http to https RewriteCond %{HTTP:X-Forwarded-Proto} !=https RewriteRule .*...
user avatar
  • 1,999
2 votes

From a Twig template, how to retrieve the content of a HTTP header in the current request?

craft.app.request.getHeaders() returns an instance of yii\web\HeaderCollection, which has a number of public methods you can use from a Twig template. For example, to see if an isAjax header is ...
user avatar
2 votes
Accepted

Sprig "Load more" not loading over https

Sprig will use whatever your site's base URL is set to, to construct the action URL. Ensure in Settings → Sites that the base URL is either set to an absolute path starting with https://, or if an ...
user avatar
  • 6,341
1 vote

.dev local development

If you are using Laravel Valet, the newest version takes care of that. You may either change the domain with valet domain test, or better: automatically secure your project it with valet secure. It's ...
user avatar
  • 2,957
1 vote
Accepted

HTTPs Site - Redirects Go to HTTP First & Then HTTPs

Think we figured out the root cause of this - we have a load balancer in front of our origin server and, long story short, that load balancer was communicating with our origin server via HTTP, causing ...
user avatar
  • 659
1 vote

Craft Admin assets do not load over https (Apache & Cloudflare)

Craft's default setting is 'resourceBaseUrl' => '@web/cpresources'. If your site or Docker Container runs http, Craft seems to (correctly) determine the http setup. This is why it ignores your ...
user avatar
1 vote

Craft Admin assets do not load over https (Apache & Cloudflare)

It's probable that your Site URL in your website's config is using http rather than https. Setting it to https should force the control panel assets to load appropriately. You can change this in ...
user avatar
  • 442
1 vote
Accepted

Control panel switches to HTTPS protocol on its own

It turned out not to be Craft's fault, indeed: On the server, the HTTP_X_FORWARDED_PROTO environment variable was erroneously set to https in the reverse proxy – an issue that my hosting provider ...
user avatar
1 vote

CloudFlare Shared SSL certificate forbids CraftCMS control panel sign in

I'd give Patrol plugin a try, just activate secure connections.
user avatar
  • 413
1 vote

When redirecting to HTTPS from www, index.php appears in URL

Using MediaTemple, I have this working: #FORCE HTTPS RewriteCond %{HTTPS} !=on RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301] <IfModule mod_rewrite.c> RewriteEngine On # ...
user avatar
  • 326

Only top scored, non community-wiki answers of a minimum length are eligible