Admin SSL not working??

[styledata]

I just enabled (I thought) Admin SSL by changing to the following in the configure.php file in the admin directory:
define('ENABLE_SSL_ADMIN', 'true');

Now, when I go to the admin login page, I get https, and when I login the initial page is https. But as soon as I click on any other link within admin, it reverts to http.

Did I miss anything?
Thank you in advance!

[TheOracle]

That is a normal procedure. A long time ago, I reported this behavior myself on the old forum. Zen-Cart uses switches between HTTP and HTTPS protocol - depending on which pages it is required to be SSL, or not, during your sessions activities (as this goes the same over the store-front).

[styledata]

Well... I sure wish that when I'm viewing a customers order with CC and all that info it was on https. It's not doing that.
Thanks

[TheOracle]

Well... I sure wish that when I'm viewing a customers order with CC and all that info it was on https. It's not doing that.

Your point of vue is quite understandable. However, as long as you're working under the admin section, the DEV team assured the safety of the administration's navigation end. Each actions you are applying, (without mentionning any MODs that might be involved but simply from the core - speaking), there's nothing to be concerned about.

Of course, bugs are constantly reported between each releases of Zen-Cart (over the 'Bug reports' section of the forum) as it also helps concerned users who thinks that Zen-Cart operates differently as it should operate normally.

Meaning, in case you might encounter errornous with Zen-Cart and, might think it's a bug, you can always report these activities over that section so that the DEV team could try to reproduce the error and confirm if it's really a bug or not to you.

[RushRC]

Well... I sure wish that when I'm viewing a customers order with CC and all that info it was on https. It's not doing that.
Thanks

I am having the same concern as I have this very issue. When you are in the admin section it should be secured and when your not on https pages you are not secured - correct?

Is there a way to secure the whole site to use only https?

[TheOracle]

I am having the same concern as I have this very issue. When you are in the admin section it should be secured and when your not on https pages you are not secured - correct?

Not entirely correct. As long as your ZenID is involved in your URL, your sessions activities are encrypted. Sure, it does help when you're under the SSL protocol to view your page as it makes a harder job for hackers to hunt your admin account(s) down. Althought, you must realize that it uses more server ressources to maintain all pages under SSL. Which is why, switches has been placed by the DEV team.

Is there a way to secure the whole site to use only https?

Which brings the answer to a no.

1 - More server ressources as, even, most pages doesn't require to be under SSL. From that point, it would become useless.

2 - If option 1 were useful and that the DEV team releases a new version of Zen-Cart, you'd still need to redo the switching manually again from the cores. It is unlikely you'd like to redo the same steps all over again.

[Ajeh]

1 set both settings to be your secure site for the admin

2 don't collect all CC info, use the split email address
You are asking for trouble if you store all the info in the database and this is against the rules for credit cards

Besides, when you get hacked do you really want the liability?

[styledata]

1 set both settings to be your secure site for the admin

What is the other setting besides the configure.php file in the admin/includes folder?
Thank you

[TheOracle]

There are no other direct settings except, of course, under the admin section in order to write into your SQL server for any modified settings.

[styledata]

There are no other direct settings except, of course, under the admin section in order to write into your SQL server for any modified settings.

I'm not sure what you just said :)
Ajeh makes reference to two settings, I know about configure.php in the admin/includes folder, I'm wondering what the other one is.