Secure and Unsecure issues

Hello all, I just recently started creating an online store for my church. Everything has been going great so far due to the vast amount of information available on these forums.

One issue I have encountered, though, is that I can not stay logged onto my account when go from a page that uses SSL to a page that does not. For example: I log into my ZenCart and am loaded into the 'My Account' page (The My Account page uses the SSL url). If I then click on another link such as 'Home' or even a product, it brings me to that page but makes it appear as if I was never logged in. If I click 'Log In' again it brings me to My Account as if I was logged in the entire time. The only difference between pages that keep me logged in and pages that don't is the use of SSL. This is the portion of my configuration.php that I edited to enable SSL:

<?php
/**
 *
 * @package Configuration Settings
 * @copyright Copyright 2003-2006 Zen Cart Development Team
 * @copyright Portions Copyright 2003 osCommerce
 * @license http://www.zen-cart.com/license/2_0.txt GNU Public License V2.0
 */


/*************** NOTE: This file is similar, but DIFFERENT from the "admin" version of configure.php. ***********/
/***************       The 2 files should be kept separate and not used to overwrite each other.      ***********/

// Define the webserver and path parameters
  // HTTP_SERVER is your Main webserver: eg, http://www.yourdomain.com
  // HTTPS_SERVER is your Secure webserver: eg, https://www.yourdomain.com
  define('HTTP_SERVER', 'http://renewalofthelordstemple.com');
  define('HTTPS_SERVER', 'https://ssl17.servage.net/renewalofthelordstemple.com');

  // Use secure webserver for checkout procedure?
  define('ENABLE_SSL', 'true');

If you desire, you can goto https://www.renewalofthelordstemple.com/store and make an account to see this problem in action. I've tested it both in IE and Firefox.

Thanks in advance for any help.

You have account approval set up, so we can't log in and poke around.

Other than the Login/Create Account page and the Checkout pages, your site shouldn't be secured. It looks like you're using a shared SSL certificate. It may not have been set up properly.

I always recommend a dedicated SSL certificate - they aren't that expensive, and usually will prevent this kind of problem.

stevesh:

You have account approval set up, so we can't log in and poke around.

Other than the Login/Create Account page and the Checkout pages, your site shouldn't be secured. It looks like you're using a shared SSL certificate. It may not have been set up properly.

I always recommend a dedicated SSL certificate - they aren't that expensive, and usually will prevent this kind of problem.

Well, I disabled account approval sorry about that. And my host gave me this SSL certificate for free...I saw verisign's price was 1K+ a year...:no:

I'd appreciate if you poked around now that you can though :D

Turns out I was mistaken about the My Account page - it appears that it is secured, too.

When I add a product to my shopping cart, and then click 'Checkout', i see:

Whoops! Sorry, but you are not allowed to perform the action requested.
You are still logged in to your account and may continue shopping. Please choose a destination from a menu.

I have no idea what that means, but I'm still thinking the SSL certificate is not set up properly.

If you Google 'SSL Certificate", you'll find certs for a lot less than 1K. Never go to Verisign for anything. My host charges $100 a year, and that's high.

You also have the secure/non-secure error showing in IE7 on every page, but I can't tell what is causing it.

Okay, I'd just hate to invest money into a cert to only find out that it wasn't the issue. But I suppose I don't have much of a choice. Thanks for the help. :smile:

Well it seems you were correct, after getting set up with my own certificate things work great. Thank You Very Much

I made a thread about this last night, but woke up in the morning to find it gone. If this is in the wrong spot/unwanted please at least PM telling me so. But perhaps there was some freak glitch that made my thread disappear :huh: Well anyway...

As per the recommendation of the Zen Cart FAQ and a fellow forum user I bought my own SSL certificate to use for my church's online store ( https://www.renewalofthelordstemple.com/store --My host is having some issues so unfortunately this page may or may not load for you).

Unfortunately, in IE I receive a warning, when accessing pages such as login and check out, that says "This page has secure and unsecure items...would you like to load the un secure items?" --Not exactly the warning but something along those lines. In FireFox no warning appears, but the little lock has a red line running through it.

Now I have read MANY threads about this, and the ONLY fix I ever saw was tracking down hard coded http:// urls in the code. I've checked my code 100x over and could not find any! My flash banner had a relative address, but in my desperation I made it absolute and used "https://". But still nothing.

I read a good way to find the offending images was to use Firefox's page information utility to see what images do not start with "https://". To my dismay all the Zen Cart images do not begin with "https://" ! In fact my flash banner is now the only secure image. Can anyone point me in the right direction to resolving this?

Sorry for the long post, but thank you for any help in advanced.

P.S. - Once again, I do not know why my original thread disappeared but if a mod is going to delete it could you please PM and tell me?

Thanks!
David.

What Mods do you have installed, and just changing the url to https in the scripts does not mean that that url is on a secure server.

Make sure you check the footer.

pete

I have no mods installed, I've only changed some core files to allow people to enter donation amounts instead of paying fixed prices. And in the footer I'm running a javascript from my host that shows my site is secure in the bottom right hand corner. But that is secure...

<script type="text/javascript" src="https://siteseal.servage.net/html.php?seal=2"></script>

I just tried removing it, but I still get the issues. Also I've switched my flash banner back to being relative rather then absolute with https://

This is quite frustrating.

Well I managed to get in,
Parse Time: 94.601 - Number of Queries: 121 - Query Time: 97.724540222

it happened to open while I was looking at something else before I posted..

If you do a quick search of the forums for your host I beleive this has been dealt with before, ( not sure it was solved but at least talked about )

If memory servers me your host has issues with ssl setups.

did you buy a dedicated ssl or did you buy their shared ssl?

I only ask because the ssl siteseal is produced by your host

Merlinpa1969:

Well I managed to get in,
Parse Time: 94.601 - Number of Queries: 121 - Query Time: 97.724540222

it happened to open while I was looking at something else before I posted..

If you do a quick search of the forums for your host I beleive this has been dealt with before, ( not sure it was solved but at least talked about )

If memory servers me your host has issues with ssl setups.

did you buy a dedicated ssl or did you buy their shared ssl?

I only ask because the ssl siteseal is produced by your host

Yea, excuse the loading time. They are apparently having issues with the cluster that contains Zen Carts MySQL DB. My certificate is purchased from them, supposedly it is not shared. They do offer a free shared one, but I paid for my own. I'll do the search for my host, thanks for the tip. (I didn't get an SSL from elsewhere because they do not allow third party SSL certificates).

that should be a clue

as a host we offer a free shared we sell dedicateds but we dont care if people get third party we just dont support it thats all...

Merlinpa1969:

that should be a clue

as a host we offer a free shared we sell dedicateds but we dont care if people get third party we just dont support it thats all...

If I wanted to talk to them about this, I'm not very versed in SSL certificates, what are some questions that I need to ask them to see if they are truly the issue?

Thanks for your time.
David

Your threads have been merged together.

rather than talking to your hoist right away I would search this forum for them and see what issues other have had with the SSL

Kim:

Your threads have been merged together.

You merged a thread with a separate issue I had..but okay :P

Well, I've done a round of searching and the only solid thread I found where the issue was similar to mine and seemed to be on servage's end was http://www.zen-cart.com/forum/showthread.php?t=89615&highlight=servage&page=3

And DrBytes solution was to replace some code..

DrByte:

Does it work also if you change that line to this instead:

$request_type = ((isset($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) == 'on') || (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == '1') || (isset($_SERVER['HTTP_X_FORWARDED_BY']) && strstr(strtoupper($_SERVER['HTTP_X_FORWARDED_BY']),'SSL')) || (isset($_SERVER['HTTP_X_FORWARDED_HOST']) && (strstr(strtoupper($_SERVER['HTTP_X_FORWARDED_HOST']),'SSL') || strstr(strtoupper($_SERVER['HTTP_X_FORWARDED_HOST']),str_replace('https://', '', HTTPS_SERVER))) ) || || (isset($_SERVER['SCRIPT_URI']) && strtolower(substr($_SERVER['SCRIPT_URI'], 0, 6)) == 'https:') || (isset($_SERVER['SERVER_PORT']) && $_SERVER['SERVER_PORT'] == '443' ) ) ? 'SSL' : 'NONSSL';

But doing so did not fix the issue for me. :-(

Sorry for the...wow triple post :blush:

I overlooked the solution Badvoc used in his thread: http://www.zen-cart.com/forum/showthread.php?t=89615&highlight=servage&page=3

And it worked! Thanks for all the help everyone...and anyone who has servage and is experiencing similar issues described here, try these instructions (Thanks Badvoc!):

Comment out the original lines (use // in front of them) and add the following underneath:

$request_type = (getenv('HTTP_X_FORWARDED_HOST') == 'sslurl') ? 'SSL' : 'NONSSL';

The files and lines are:

admin\includes\init_includes\init_file_db_names.php Line 20
includes\init_includes\init_file_db_names.php Line 18
includes\modules\payment\paypal\ipn_application_top.php Line 46

I think that's them all. Basically we need to set the variable $request_type to either SSL or NOSSL appropriately.

Where it says 'sslurl' just put the URL you have to SSL, NOT INCLUDING HTTPS:// OR HTTP://

So for example, my url is https://renewalofthelordstemple.com so I did:

$request_type = (getenv('HTTP_X_FORWARDED_HOST') == 'renewalofthelordstemple.com') ? 'SSL' : 'NONSSL';