Sign in

hunting one stray http:// link across a laravel app. tips?

Solvedhttpsmixed-contentssl4 replies · 290 views · started
Reply
Accepted solution by Aiden Becker — if the app sits behind a load balancer or proxy that terminates TLS, the app may think requests are plain http and generate http://…
  1. Malik M.
    @mmoreau_10

    im literally losing my mind here i thought turning on HTTPS would be a five-minute job. instead a Laravel app looks broken: a padlock with a warning triangle.

    Your connection is not private

    Your connection is not private
Attackers might be trying to steal your information from portal.example.org
(for example, passwords, messages, or credit cards).
NET::ERR_CERT_DATE_INVALID

    In the console there are messages about mixed content and the main scrpit being blocked. The certificate itself seems fine. Im behind the hosts load balancer, if that matters :/ Whats the cleanest way to fix this for good, not just patch one URL? Any pointers on where these links usually hide would be very welcome.

    14
  2. Aiden Becker
    @packet_pilot

    uhh did u update the site URL setting in the app iteslf, not just install teh certificate? ??

    0 1 helpful
  3. Malik M.
    @mmoreau_10
    in reply to @packet_pilot

    ahh right i only installed the certificate. the app settings still have teh http:// address for a Laravel app. hope thats enough info 😅

    0 2 helpful
  4. Aiden Becker
    @packet_pilot

    yeahhh as a safety net, add the header Content-Security-Policy: upgrade-insecure-requests. Browsers will then request http subresources over https automatically :/ It only works if those resources are actually available over https, sooo it complements teh real fix rather than replacing it. fingers crossed 🤞

    2 2 helpful
  5. Aiden Becker
    @packet_pilot
    Accepted solution

    if the app sits behind a load balancer or proxy that terminates TLS, the app may think requests are plain http and generate http:// links... make it trust X-Forwarded-Proto: Laravels TrustProxies middleware, Djangos SECURE_PROXY_SSL_HEADER, or in WordPress set $_SERVER['HTTPS'] = 'on' when that header says https.

    0 6 helpful

Reply to this topic

Sign in or create an account to reply.