Getting cart pages to work over https: (SSL)

10 replies [Last post]

Wed, 03/23/2011 - 05:14

Offline

Joined: 11/11/2010

Juice: 54

I'm building a Drupal 6 site with the latest version of Ubercart. I've had an SSL certificate installed on my web server by my web host. They advise that all I need to do to get specific pages to run over SSL is to simply provide links to the https: version of the page rather than the normal http: version. So I've done this manually with my /cart/checkout and /cart/checkout/review pages. The problem is that when the you start shopping on the normal http: pages, even though the cart has items in it, when you go to the https: checkout page, your cart suddenly shows no items. If you then navigate back to the http: version your original cart items reappear, but if you stay in https: and add items to your basket from scratch you get a whole new cart of items. So it seems Ubercart regards the http: and https: carts as separate entities.

I've tried installing the Secure Pages module but that gave me the runaround, so I uninstalled that and installed the Ubercart SSL module instead, but that didn't do the trick either. The Secure Pages module "documentation" (i.e. loads of different user questions and comments) is very difficult to follow. Can anyone explain in simple English what I have to do to get my cart pages to run over https: ?

Grateful for any assistance

Wed, 03/23/2011 - 05:28

#1 View page

heartdriven

Offline

Joined: 03/23/2011

Juice: 3

Re: Getting cart pages to work over https: (SSL)

Indeed, the ssl version of your website is being considered as a different website from a browser perspective. This is because the cookie saves your session under a different ID. For security reasons, I suggest that you use ssl for every part of your website. You can do so using this dirty hack in .htaccess or using the securepages module and messing around with the settings. I prefer the second solution, because it doesn't hack core

Sincerely

Fri, 03/25/2011 - 06:32

#2 View page

awebmanager

Offline

Joined: 11/11/2010

Juice: 54

Thanks :)

Cheers for the suggestions. Yes I agree it seems the easiest way is to get the whole site to run over https:

It's really annoying that the Secure Pages module just says "don't enable this module without setting up your Drupal configuration for SSL first" and then doesn't give any information about this whatsoever

Sat, 03/26/2011 - 15:14

#3 View page

end user

Offline

Joined: 01/11/2008

Juice: 1198

Re: Getting cart pages to work over https: (SSL)

Well whats not working with the Secure Page? What settings you do have?

Sun, 03/27/2011 - 09:46

#4 View page

awebmanager

Offline

Joined: 11/11/2010

Juice: 54

Secure Pages setup

Hi, thanks for the question

Firstly just to say my web host installed the secure certificate a few weeks back for the domain https://mysite.com and this works fine, i.e. if you go to any https: url without Secure Pages being enabled, you stay in https: the whole time, and likewise if you go to www.mysite.com you remain in non-secure mode the whole time.

I don't know if this is relevant but I have a multi-site setup, with three domains that point to their own Drupal sites on a shared hosting. Under /public_html/ I have these folders:
/sites/all (where the shared codebase for all sites lives)
/sites/mysite.com (the one in question)
/sites/default
/sites/mymainsite.com
/sites/myothersite.com

The SSL certificate is only installed for mysite.com and I have no other certificates installed on the server.

Some of the posts I've read on the Secure Pages module talk about changing settings in .htaccess and settings.php. Again don't know if it's relevant but the only difference in the settings.php file in the mysite.com folder and the one in the default folder is that in mysite.com I don't have any base URL set, while for default I have the base URL set as http://www.mymainsite.com The .htaccess file in all the site folders is the same as far as I can see.

Anyway, if I enable the Secure Pages module whilst in mysite.com, my setup is:
Secure Pages - enabled
Switch back to http pages when there are no matches - ticked
Non-secure Base URL: http://www.mysite.com
Secure Base URL: https://mysite.com
Make secure only the listed pages:
node/add*
node/*/edit
user
user/*
admin
admin/*
cart/checkout
cart/checkout/review
Ignore pages:
*/autocomplete/*
*/ajax/*

I use Firefox to do the admin for my site and IE to test as a public user. When testing the secure pages I get different results in the different browsers as follows:
1) If I open a new browser session in IE and am not logged in, I put a product in my basket in non-secure mode, but when I navigate to either http://www.mysite.com/cart/checkout or https://mysite.com/cart/checkout I just get taken back to http://www.mysite.com/cart and can never get to the checkout page.
2) If I open a new browser session in FF and am not logged in, I can get to the checkout page, but only because I get logged in automatically somehow when navigating to https://mysite.com/cart/checkout

In the latter case, even though I am now in the secure checkout page, the "payment method" pane breaks - I get the animated zig-zag bar thing which you get when the system is processing something, but it never resolves, so I can't enter any credit card details. If I click "review order" though, the checkout form page reloads with a message saying I haven't entered any card details - but this time the credit card pane is OK. I enter the card details and can then click through to review the order and submit and get a "your order has been processed!" message. However, if I then go back to the cart, I get these problems:
1) the product I "bought" is still in the cart
2) I get neither a customer order confirmation email or an admin confirmation email (which both work fine when not trying to use the secure pages process)
3) if I check "my orders" the order doesn't show up
4) if I check all orders as admin, the order has been created but is flagged as "in checkout". (This I suppose is what's happening in the logged-out IE session where I can never get past the cart page.)

I confirm that if I disable the Secure Pages module and follow the entire order process in *either* secure or non-secure mode (i.e. without switching between the two modes during the process), as *either* an anonymous user or as admin, the order is processed normally without any issues at all.

Frustrated!

Mon, 03/28/2011 - 09:14

#5 View page

Kalorlo

Offline

Joined: 11/19/2010

Juice: 75

Re: Getting cart pages to work over https: (SSL)

Have you tried looking at this topic: Cart becomes empty upon checkout - HTTP to HTTPS on different domains? #12 shows how to set the cookie_domain so that you keep the same cookie when going from http://www.example.com to https://example.com.

I don't know if this is related to your most recent problems, but it may well be.

Thu, 03/31/2011 - 03:17

#6 View page

awebmanager

Offline

Joined: 11/11/2010

Juice: 54

Thanks Kalorlo

Cheers for the link - sadly though I've tried everything on that thread and am back to square one. I've posted back to that thread to see if anyone there can help: http://www.ubercart.org/forum/support/10429/cart_becomes_empty_upon_chec...

Mon, 03/28/2011 - 19:27

#7 View page

yalis reaper

Offline

Joined: 02/28/2011

Juice: 27

ubercart, secure pages

I too have been working with drupal 6, secure pages, and ubercart to develop my first drupal website. I don't know if this is related, by my product pages come over https, but the security icon (padlock) on the bottom of my browser has a warning telling me there is unsecure content on the page. The secure application form works fine and the cart works fine, but the intermediary step where the entrant adds the "product" to the cart won't secure properly. Thanks to anyone who can clarify this.

Tue, 03/29/2011 - 04:18

#8 View page

Kalorlo

Offline

Joined: 11/19/2010

Juice: 75

Re: ubercart, secure pages

Often this is caused by using absolute paths to elements in the page, frequently images - this means it's loading them from the http:// address and that'll give you the unsecure content warning. Try and find out what the unsecure content is.

Tue, 03/29/2011 - 11:42

#9 View page

yalis reaper

Offline

Joined: 02/28/2011

Juice: 27

absolute paths

Thanks, I think I did use absolute paths somewhere. I did have trouble figuring out what the unsecure content was.

Tue, 03/29/2011 - 23:36

#10 View page

yalis reaper

Offline

Joined: 02/28/2011

Juice: 27

insecure emoticon

Just incase this comes up for someone else, the insecure content was an emoticon used in one of my blocks. Once that is removed, the problem disappears. I was a bit surprised, I think it was generated by the fckeditor.

Ubercart

Navigation

User login