secure main page after logging in

[edadk]

Hi,

On my site, after a customer logs in, they are taken to the main page with SSL still enabled.

If they then immediately search, they get a warning that unencrypted info will be sent. (Clicking any other link gives the user a regular non-ssl page, which is fine.)

I'd like to eliminate the unencrypted error notice by having the customer go to a non-ssl main page after they log in.

Since my site is somewhat customized, I don't know if the customer lands on an ssl-enabled page after login by design or if that's a quirk in my system.

In any case, I want the main page to be non-ssl after login.

How can I change the post-login main page to be non-ssl?

I running 1.39d

Many thanks,

Ed

[dbltoe]

In your "admin" includes/configure.php, are all your http# defines listed as https or are they different for each?

define('HTTP_SERVER', 'http://www.something.com');
define('HTTPS_SERVER', 'https://www.something.com');
define('HTTP_CATALOG_SERVER', 'http://www.something.com');
define('HTTPS_CATALOG_SERVER', 'https://www.something.com');

[edadk]

I have all of them set to https in admin.

Ed

[dbltoe]

They need to be as in my post. Http for http and https for https

[DrByte]

In your "admin" includes/configure.php, are all your http# defines listed as https or are they different for each?

define('HTTP_SERVER', 'http://www.something.com');
define('HTTPS_SERVER', 'https://www.something.com');
define('HTTP_CATALOG_SERVER', 'http://www.something.com');
define('HTTPS_CATALOG_SERVER', 'https://www.something.com');

I have all of them set to https in admin.

Ed

They need to be as in my post. Http for http and https for https

dbltoe,
The OP is talking about a store-side preference, not an admin issue.z

[edadk]

They need to be as in my post. Http for http and https for https

Thanks for the suggestion but that does not have any effect for me other than taking away ssl on most of the admin side.

This issue also occurs when a user logs out, the next page they are shown is secure, so if the user then performs a search on that page, they get the same warning about info being sent insecurely.

Again, immediately after login or logout, the user is dropped onto a secure page. If the user then attempts to do a search from the secure page, they receive a popup warning about info being sent insecurely.

Ed

[Kim]

Are you actually getting complaints from your customers about this problem?

Unfortunately, there is not a way to totally cure the problem except to run the whole store under SSL or don't run SSL at all, neither of those choices is acceptable.

If you don't make the page after an SSL page appear to be SSL you get other security warnings. So we have minimized the circumstances to limit the possible problems.

[edadk]

Are you actually getting complaints from your customers about this problem?

Unfortunately, there is not a way to totally cure the problem except to run the whole store under SSL or don't run SSL at all, neither of those choices is acceptable.

If you don't make the page after an SSL page appear to be SSL you get other security warnings. So we have minimized the circumstances to limit the possible problems.

Thank you for your reply.

Perhaps I'm looking at this with blinders on.

Would it be possible to modify the search box so that it will take into account whether or not the search is being performed from a secure page?

Many thanks,

Ed

[DrByte]

What is your site URL?
What template are you using?

I'm not seeing the behavior you describe, when using a fresh install of v1.3.9d

[edadk]

What is your site URL?
What template are you using?

I'm not seeing the behavior you describe, when using a fresh install of v1.3.9d

I'm using my own custom template.

I'll pm you a link, I do not want to post it in the forum.

thanks,

Ed