hunting one stray http:// link across a laravel app. tips?

Solvedhttpsmixed-contentssl4 replies · 296 views · started

Accepted solution

by Aiden BeckerJump to the reply

if the app sits behind a load balancer or proxy that terminates TLS, the app may think requests are plain http and generate http:// links... make it trust X-Forwarded-Proto: Laravels TrustProxies middleware, Djangos SECURE_PROXY_SSL_HEADER, or in WordPress set $_SERVER['HTTPS'] = 'on' when that header says https.

  1. im literally losing my mind here i thought turning on HTTPS would be a five-minute job. instead a Laravel app looks broken: a padlock with a warning triangle.

    Your connection is not private

    Your connection is not private
    Attackers might be trying to steal your information from portal.example.org
    (for example, passwords, messages, or credit cards).
    NET::ERR_CERT_DATE_INVALID
    

    In the console there are messages about mixed content and the main scrpit being blocked. The certificate itself seems fine. Im behind the hosts load balancer, if that matters :/ Whats the cleanest way to fix this for good, not just patch one URL? Any pointers on where these links usually hide would be very welcome.

    14
  2. ahh right i only installed the certificate. the app settings still have teh http:// address for a Laravel app. hope thats enough info 😅

    0 2 helpful
  3. yeahhh as a safety net, add the header Content-Security-Policy: upgrade-insecure-requests. Browsers will then request http subresources over https automatically :/ It only works if those resources are actually available over https, sooo it complements teh real fix rather than replacing it. fingers crossed 🤞

    2 2 helpful
  4. Accepted solution

    if the app sits behind a load balancer or proxy that terminates TLS, the app may think requests are plain http and generate http:// links... make it trust X-Forwarded-Proto: Laravels TrustProxies middleware, Djangos SECURE_PROXY_SSL_HEADER, or in WordPress set $_SERVER['HTTPS'] = 'on' when that header says https.

    0 6 helpful

Reply to this topic

Sign in or create an account to reply.