Setting up SSL - Advanced Search returns http page

[web-project]

also highly recommended to redirect all http requests to https via .htaccess file as this way will be more secure.

[carlwhat]

also highly recommended to redirect all http requests to https via .htaccess file as this way will be more secure.

do you care to elaborate? not sure how redirects through .htaccess makes anything more or less secure.

[guyos]

If the content is accessible by https: then yes. As stated there are other ways as well.

Could you give more info about what the other ways are..

[mc12345678]

do you care to elaborate? not sure how redirects through .htaccess makes anything more or less secure.

I would agree with the question, although perhaps the presentation of the information was not quite right.

The thought there is, if the site is to be accessed always using https:, then there should not be a way to access the site using just http:. That said, ZC has for a really long time been designed to make the link(s) to the next page support the expected method of communication to support the destination. There have been outside influences that are saying that all pages should be https:

For example, if you access index.php?main_page=login, you'll notice that the page is served as http:, but if you submit the information it will be pushed as https: (assuming SSL is installed, enabled, and HTTPS_SERVER if present is left with the default beginning with https:).

So the information is transferred using the security aforded by having an SSL, but the page will "appear" as being insecure to a browser.

[mc12345678]

Could you give more info about what the other ways are..

Well I can answer one other way that comes to mind, but there is also a bit of discussion related to that as well. That other discussion was at one point in the forum, I don't know if a moderator removed it or not.

Instead of identifying a protocol at the beginning of the url, you could leave it without a protocol and have it begin "simply" with //. So instead of http: or https:, it would begin with // followed by the "server"/domain name and then the path to the resource.

The potential issue with this method is that the associated information will be retrieved using whatever protocol was used to access the page. A concern that was expressed and the details around it I have forgotten was if the "page" was accessed using ftp: or some other protocol then that page/resource might be attempted to be provided using that protocol... other issues may be that if the site were locally hosted and accessed from the drive as in c:\... then that resource (likely to be needed from the internet) will be sought from the local computer instead...

[carlwhat]

Could you give more info about what the other ways are..

i would review:

https://www.w3schools.com/html/html_filepaths.asp
https://stackoverflow.com/questions/...o-the-css-file

after reviewing those links i would use the following:

background-image:url('../../../../images/cart.gif'); 

//or
background-image:url('/images/cart.gif'); 

background-image:url('../images/test.png');

that is how i would do it....

although i would be tempted to copy the cart.gif image file to the images directory within your template and then reference it the same way as test.png.

best.

[guyos]

i would review:

https://www.w3schools.com/html/html_filepaths.asp
https://stackoverflow.com/questions/...o-the-css-file

after reviewing those links i would use the following:

background-image:url('../../../../images/cart.gif'); 

//or
background-image:url('/images/cart.gif'); 

background-image:url('../images/test.png');

that is how i would do it....

although i would be tempted to copy the cart.gif image file to the images directory within your template and then reference it the same way as test.png.

best.

I changde the code first to a relative path - no effect
Then changed the code to a absolute (https) path - Still no effect ?

[carlwhat]

I changde the code first to a relative path - no effect
Then changed the code to a absolute (https) path - Still no effect ?

css is a resource that most browsers will cache. there are various settings to indicate length of time to cache said resource....

if you do a HARD reload of the page in order that your browser downloads the new css, you will see that you are now secure:




best.

[guyos]

Thx guys, again learned a lot from this forum...