Base HREF https issues

Hi all..

Been searching the forums for days trying to find an answer.. but with no joy :no:

I'm getting the "This page contains both secure and nonsecure items... " warning on IE (and similar in FF) I've seen several people say hard coded HTTP: links are the issue, but I can see any on my site. The only thing I'm thinking it could be is the <base href=http in my code.

HOW do you change this to <base href=https ? Or is this not the problem?

My website: www.sourcetech.co.uk

Please help!!

Mike

What values are you putting in your configure.php files for:

define('HTTP_SERVER', 'http://xxxxxxxxxxxxxxxxxxxx');
define('HTTPS_SERVER', 'https://xxxxxxxxxxxxxxxxxxxx');

Hi fairestcape, both my configure files say the following:

define('HTTP_SERVER', 'http://www.sourcetech.co.uk');
define('HTTPS_SERVER', 'https://www.sourcetech.co.uk');

That seems right. I just tried adding "/shop" onto the end, just on the off-chance that this worked.. and it managed to kill the entire site! Not such a good idea then! :unsure:

These paths to http and https look quite correct.

(Is your SSL cert for www.sourcetech.co.uk, or just sourcetech.co.uk?)

HTTPS is invoked by zencart only when necessary - ie: when sensitive data is being transmitted. (Names, Addresses, Checkout process).

Most of the time, it operates in http mode.

If you are getting "Insecure elements" warnings when logging in, or going through checkout, then this is generally a result of a http:// URL embedded somewhere in the code calling https: (It could be in a define page, or a template file.

When the message appears, say "No, don't display insecure items", then look at the output to see what's missing... That's your clue as to how to resolve it.

Here are the insecure items...

<script language="javascript" type="text/javascript"><!--
function session_win() {
  window.open("http://www.sourcetech.co.uk/shop/index.php?main_page=info_shopping_cart","info_shopping_cart","height=460,width=430,toolbar=no,statusbar=no,scrollbars=yes").focus();
}
//--></script>

<script type="text/javascript" src="http://download.skype.com/share/skypebuttons/js/skypeCheck.js">

<img src="http://mystatus.skype.com/balloon/mike.r.backhouse" style="border: none;" width="140" height="56" alt="My status" />

<a onClick="window.open('http://www.shopmania.co.uk/?m=139'); return false;" alt="Visit Sourcetech.co.uk on ShopMania" target="_blank" href="http://www.shopmania.co.uk"><img border="0" title="Visit Sourcetech.co.uk on ShopMania" src="http://www.shopmania.co.uk/img/cert/shopmania-store-uk.gif" alt="" /></a></p>
            <p>

~Melanie

Thank you for replies, really blows me away when people take the time to help.

fairestcape, I'll check our SSL certificate, my MD who actually bought it, is under the impression that it IS minus the www, so that could well be the problem..

mprough, I noticed the same things when checking the source code. So I've now switched off the skype sidebox and the box that contained the shopmania link. Cant for the life of me figure out where that bit of javascript's coming from:

<script language="javascript" type="text/javascript"><!--
function session_win() {
  window.open("http://www.sourcetech.co.uk/shop/index.php?main_page=info_shopping_cart","info_shopping_cart","height=460,width=430,toolbar=no,statusbar=no,scrollbars=yes").focus();
}
//--></script>

So I'll take a better look at that asap.

Question.. if there are ANY hard coded links on the site, even to external sites, then this will cause issues with HTTPS? How do I get round linking to say http://www.google.com, when there isnt an HTTPS alternative? :unsure:

Internal links can be absolute... External links must be to secured pages.

If your www/non www was incorrect on the SSL it would display an error and not load the page at all....

~Melanie

Related FAQs:
https://www.zen-cart.com/tutorials/index.php?article=150
https://www.zen-cart.com/tutorials/index.php?article=14

How deep does the rabbit hole go?....when on the login page, which should be secure I see a base href of ```

Who is the hosting company?
A few hosts are known to be unable to support SSL using conventional methods.

barco57:

How deep does the rabbit hole go?....when on the login page, which should be secure I see a base href of ```

includes/configure.php

secure checkout set to true?

admin/includes/configure.php ssl catalog false?

~Melanie

exactly my point, it isn't changing correctly.

~Melanie

You can not call stylesheets and images unsecure into a secure page even if it is the same domain. Use firefox and check the dependencies on the page. I troubleshoot these issues everyday. once those are cleared up the page will work.

Hmmmm...

So why is it not switching correctly then.

Check these settings...

includes/configure.php

define('HTTP_SERVER', 'http://www.sourcetech.co.uk');
define('HTTPS_SERVER', 'https://www.sourcetech.co.uk');

// Use secure webserver for checkout procedure?
define('ENABLE_SSL', 'true');

admin/includes/configure.php

  define('HTTP_SERVER', 'http://www.sourcetech.co.uk);
  define('HTTPS_SERVER', 'https://www.sourcetech.co.uk');
  define('HTTP_CATALOG_SERVER', 'http://www.sourcetech.co.uk');
  define('HTTPS_CATALOG_SERVER', 'https://www.sourcetech.co.uk');

  // secure webserver for catalog module and/or admin areas?
  define('ENABLE_SSL_CATALOG', 'false');
  define('ENABLE_SSL_ADMIN', 'false');

~Melanie

And this I don't think is going to fly

<script language="javascript" type="text/javascript"><!--
function session_win() {
  window.open("http://www.sourcetech.co.uk/shop/index.php?main_page=info_shopping_cart","info_shopping_cart","height=460,width=430,toolbar=no,statusbar=no,scrollbars=yes").focus();
}
//--></script>

I don't think this will work... I actually had to make a way to use a lightbox script I wanted, but on SSL pages it would not stop making errors... So since it isn't used on SSL pages, now its not included.

Also, your shopping cart page is SSL and should not be, this is likely a config error.

~Melanie

I would be curious to see what the following line in includes/templates/iC_AthemeV1.3/common/html_header.php looks like:```

Hi Drbyte.. Who's the hosting company? We are!! We have our own webserver in a rack locally

I was wondering about the base HREF=http: etc.. I presume this has been the issue, but no idea how to change it!

Hi Drbyte.. We have our own webserver in a rack locally, so host our own websites. Which is both handy and annoying all at the same time!

I was wondering about the base HREF=http: etc.. I presume this has been the issue, but no idea how to change it!

Checked the 2 config files, definately ok

Checked the html_header.php and that lines definately ok thanks

Shopping cart IS SSL, but definately isnt causing the problem, because I was having these problems before setting that to SSL. That said, I'll change it back anyway

Cant find the javascript which is causing the problem, I would love nothing more than to remove that! I'll carry on the hunt!!

<script language="javascript" type="text/javascript"><!--
function session_win() {
  window.open("http://www.sourcetech.co.uk/shop/index.php?main_page=info_shopping_cart","info_shopping_cart","height=460,width=430,toolbar=no,statusbar=no,scrollbars=yes").focus();
}
//--></script>

Things I have noticed.

• SSL Cert is issued to sourcetech.co.uk
• site does not work without the 'www' in the URL
• invalid characters in JS starting at line 96 of page output
  );
  //îòñëåæèâàíèå äîïîëíèòåëüíûõ ýëåìåíòîâ
  //addListener(document.getElementById('element-id'),

Fixing all of the above will help to sort out some or even a lot, of problems.