SSL is on, but http:// login page does not redirect to https://

I have SSL turned on in both configure files, and all of my shopping cart and login pages appear to redirect properly to the https:// pages.

BUT if I specifically type in http://www.mystore.com/index.php?main_page=login it does not redirect to the https:// version of the page. This is causing a PCI compliance error.

Any thoughts what could cause this problem?

Thanks!
:bigups:

Its the same for me, but the form sends the information to the secure link. That should be fine. So its not a problem as you said. I guess you can change the code and redirect always to the secure page for the login. Maybe in you htaccess file that would be the easiest as you dont have to change code.

i suppose it shouldn't be a problem. but PCI compliance scanner is still giving errors for it :(

do you have an example code that should be put into htaccess?

Apparently it's a false positive from the PCI scanner... so we'll be awaiting the results once more and have another go at it.

wish me luck :)

Hello there, I am going through the same problem. I want to redirect the unsecure login page to ssl login page.
could you please tell me what i am supposed to code in htaccess file?

Many thanks in advance

https://www.zen-cart.com/tutorials/index.php?article=14

Hello Kim,

Thank you for the reply. But the SSL is already turned on, as instructed in that tutorial.

The issue is that after running a PCI scan, the site has failed becuase they were able to hack and get to the login page without using the https://

ie, if you type in the login URL directly into the address bar, using http:// it will allow you to get there, instead of forwarding you along to https://

The issue is that after running a PCI scan, the site has failed becuase they were able to hack and get to the login page without using the https://

ie, if you type in the login URL directly into the address bar, using http:// it will allow you to get there, instead of forwarding you along to https://

Why should they care? A real customer is never going to change the URL and the information is still sent via HTTPS when it is submitted.

I agree, why should they care... but they do, and if it's not fixed my website does not pass PCI compliance.

What can i do to fix this?

Kim:

https://www.zen-cart.com/tutorials/index.php?article=14

Kim,

Many thanks for your reply. i did have a look at the tutorial before i posted my previous message. in fact that is how is learnt how to turn on ssl. the trouble i got now is that, when i go to admin login page the ssl is on but when click on Log in page in the site (as a customer) it is not diverting to*** https**://iwantthattoy.co.uk/index.php?main_page=login* instead it remains as
http://iwantthattoy.co.uk/index.php?main_page=login

Help please!

what compliance scanner are you using?
we have MANYYYYYYYY users that have passed their PCI Compliance scans without this issue

Some customers also look at the address bar to see if they are on an https site. I know I do.

So, it's pretty easy to change the customer login URL to https

in includes\templates\your-template\sideboxes\tpl_shopping_cart.php find the line

<a href="<?=HTTP_SERVER.DIR_WS_CATALOG?>index.php?main_page=login">Login</a>

and change the HTTP to HTTPS

<a href="<?=HTTPS_SERVER.DIR_WS_CATALOG?>index.php?main_page=login">Login</a>

Changing the code is NOT the way to do things - you need to get your HTTP and HTTPS working correctly and Zen Cart will make the switch automatically when it is needed.

But, the customer login page is not https, and this will affect conversion rates. What do you suggest?

i have the same issue, i followed all the instructions in the tutorial to enable ssl, and ssl is correctly installed i checked with the hosting provider and the ssl provider but the login page and the admin area doesn't go to https automatically. When i type in https myself it works just fine but not when the customer clicks on login.

Did anyone fine the solution for this problem??

Hi I can t see there was ever asolution to this is there one that I can try I have soent hours transferring my store to another hosting so I could have SSL cert and now the damn thing dosnt work - I have folllowed thed the tut and changet the 3 config files but it doent seem to want to work when I click in login it goes to http not https

any advice Please
Chrissie

keepsakes-by-design.co.uk

rugersmum:

Hi I can t see there was ever asolution to this is there one that I can try I have soent hours transferring my store to another hosting so I could have SSL cert and now the damn thing dosnt work - I have folllowed thed the tut and changet the 3 config files but it doent seem to want to work when I click in login it goes to http not https

any advice Please
Chrissie

keepsakes-by-design.co.uk

There is no solution for my issue. My host has a server setup that doesnt allow communication with Zencart. According to my host it's "a Zencart problem".

When I told them that I have never had this problem before, setting up probably close to 15 ZenCart shops, they just ignored me.

What I had to do was manually hardcode all the SSL pages.

// Peter

My admin login was going to https just fine, but the customer login link was going to http, rather than https, even though I had set both configure.php files according to the zen tutorial.

Using the file manager on my host system, I found that the file permission on the includes/configure.php file was set to read only (444). I set it to 644 for read/write, uploaded the configure.php file again. Problem solved. Then I changed it back to read only (444).

I hope this helps someone. :D