partially encrypted login SSL - v1.3.8, using proxy server

[vivek_advsol]

Hi There,

My Login page is partially encrypted I double checked for any hot links but none.

https://www.sportslabstores.com.au/i...ain_page=login

It is sitting in a Linux Centos machine. my Virtualhosting settings also seems to be fine.

Could someone advice me on what I am doing wrong.

Thanks.

[vivek_advsol]

Hi There,

I went through zencart forums and did the SSL test. Could some one please explain me the issue with the result i have bellow.

Array
(
[HTTP_HOST] => www.sportslabstores.com.au
[HTTP_X_REAL_IP] => 203.XXXX.XXXX.XXXX
[HTTP_X_FORWARDED_FOR] => 203.XXX.XXXX.XXXX
[HTTP_CONNECTION] => close
[HTTP_USER_AGENT] => Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0
[HTTP_ACCEPT] => text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
[HTTP_ACCEPT_LANGUAGE] => en-us,en;q=0.5
[HTTP_ACCEPT_ENCODING] => gzip, deflate
[HTTP_ACCEPT_CHARSET] => ISO-8859-1,utf-8;q=0.7,*;q=0.7
[HTTP_COOKIE] => zenid=eh4ege89uqf75js83s7fc7ntq3; __utma=51135595.1869370263.1312875994.1312875994.1312875994.1; __utmb=51135595.3.10.1312875994; __utmc=51135595; __utmz=51135595.1312875994.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); zenAdminID=kqnjjikhlrjkn79hk50ckg75k6
[PATH] => /sbin:/usr/sbin:/bin:/usr/bin
[SERVER_SIGNATURE] =>
Apache/2.2.3 (CentOS) Server at www.sportslabstores.com.au Port 80


[SERVER_SOFTWARE] => Apache/2.2.3 (CentOS)
[SERVER_NAME] => www.sportslabstores.com.au
[SERVER_ADDR] => 202.XXX.XXXX.XXXX
[SERVER_PORT] => 80
[REMOTE_ADDR] => 186.XXX.XXXX.XXXX (Proxy IP)
[DOCUMENT_ROOT] => /var/www/sportslab01ADV/htdocs
[SERVER_ADMIN] => [email protected]
[SCRIPT_FILENAME] => /var/www/sportslab01ADV/htdocs/ssltest.php
[REMOTE_PORT] => 20849
[GATEWAY_INTERFACE] => CGI/1.1
[SERVER_PROTOCOL] => HTTP/1.0
[REQUEST_METHOD] => GET
[QUERY_STRING] =>
[REQUEST_URI] => /ssltest.php
[SCRIPT_NAME] => /ssltest.php
[PHP_SELF] => /ssltest.php
[REQUEST_TIME] => 1312881030
)


SSL is configured at the proxy server.

[DrByte]

When did this problem suddenly start?

[vivek_advsol]

Hi Dr,

We moved to a dedicated host recently and got a SSL certificate as well for the first time. The site us sitting behind a proxy server which handles traffic(to prevent DDOS). we had tat kind of attack recently.

[DrByte]

Can you get your server admin to have the HTTP_X_FORWARDED_BY or HTTP_X_FORWARDED_HOST or HTTP_X_FORWARDED_SSL set, instead of just HTTP_X_FORWARDED_FOR ?

[vivek_advsol]

Hi Dr,

Protocol detected: SSL

Array
(
[HTTP_HOST] => www.sportslabstores.com.au
[HTTP_X_REAL_IP] => 203.xxx.xxx.xxx
[HTTP_X_FORWARDED_FOR] => 203xxx.xxx.xxx
[HTTP_X_FORWARDED_SSL] => on
[HTTP_X_FORWARDED_HOST] => www.sportslabstores.com.au
[HTTP_X_FORWARDED_BY] => 186.xxx.xxx.xxx:443
[HTTP_CONNECTION] => close
[HTTP_USER_AGENT] => Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0
[HTTP_ACCEPT] => text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
[HTTP_ACCEPT_LANGUAGE] => en-us,en;q=0.5
[HTTP_ACCEPT_ENCODING] => gzip, deflate
[HTTP_ACCEPT_CHARSET] => ISO-8859-1,utf-8;q=0.7,*;q=0.7
[HTTP_COOKIE] => zenid=d9ou11oo1bkpnmko19ib1tkn82; __utma=51135595.1385534463.1312932176.1312932176.1312943093.2; __utmc=51135595; __utmz=51135595.1312932176.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmb=51135595.2.10.1312943093
[PATH] => /sbin:/usr/sbin:/bin:/usr/bin
[SERVER_SIGNATURE] =>
Apache/2.2.3 (CentOS) Server at www.sportslabstores.com.au Port 80


[SERVER_SOFTWARE] => Apache/2.2.3 (CentOS)
[SERVER_NAME] => www.sportslabstores.com.au
[SERVER_ADDR] => 202.xxx.xxx.xxx
[SERVER_PORT] => 80
[REMOTE_ADDR] => 186.xxx.xxx.xxx
[DOCUMENT_ROOT] => /var/www/sportslab01ADV/htdocs
[SERVER_ADMIN] => [email protected]
[SCRIPT_FILENAME] => /var/www/sportslab01ADV/htdocs/sectest.php
[REMOTE_PORT] => 24009
[GATEWAY_INTERFACE] => CGI/1.1
[SERVER_PROTOCOL] => HTTP/1.0
[REQUEST_METHOD] => GET
[QUERY_STRING] =>
[REQUEST_URI] => /sectest.php
[SCRIPT_NAME] => /sectest.php
[PHP_SELF] => /sectest.php
[REQUEST_TIME] => 1312946601
)

[DrByte]

Great! Glad they were able to help you get it working by tweaking the server's proxy config.

[vivek_advsol]

Hi Dr

But still my login page has problems. What I am doing wrong.

https://www.sportslabstores.com.au/i...ain_page=login

[DrByte]

What Zen Cart version?

[vivek_advsol]

v 1.3.8a. Unfortunately I cannot update this at the moment.