SSL Secure all pages after logging in.

[WS Evolution]

Some customers seem to expect all pages to be secure after logging in. I am fully aware that this is not needed, but the loss of the padlock in your browser and a nice message highlighting the fact you are moving from a secure page does seem to worry the customer.

 

Has anyone implemented any code, which secures all pages when logged in? I would guess that someone else would of thought of doing this????.

 

If so how did you go about implimating the code?

 

 

Any other suggestions and help would be much appreciated.

 

 

If no one has writen code to achive this, I will be doing it my self, but theres no point reinventing the wheel so to speak!

 

Thanks in advance,

 

Gareth.

[jpweber]

Gareth -- I don't have a solution, so I'm sorry, but I do think your idea is a good idea, and I'd like to implement any solution we find to this, as well. Excellent suggestion, and I'll keep tabs on this (and research on my own), as well,

 

J

[WS Evolution]

Gareth -- I don't have a solution, so I'm sorry, but I do think your idea is a good idea, and I'd like to implement any solution we find to this, as well. Excellent suggestion, and I'll keep tabs on this (and research on my own), as well,

 

J

 

 

Thanks Jason, Looks like there will be at least two of us working on this. Hopefully I will have time tomorrow to do some further research and have a peak at the SSL related code.

[Jack_mcs]

There's no need for extra code. Just edit to your configure file to use https instead of http. You may get some error messages on some pages but that would be due to non-secure links on the page and you would have to fix those as you see them.

 

Jack

[WS Evolution]

Changing the configure file would make the shop use SSL at all times, unless I am missing something. This is not what I am after. What I would like is to have is all pages set as https only when you?re logged in.

 

Something like this in the application top:

 

   if (!tep_session_is_registered('customer_id')) {
 require('includes/configure_secure.php');
 } else {
require('includes/configure.php');
 }

 

or

 

   if (!tep_session_is_registered('customer_id')) {
define('HTTP_SERVER', 'https://www.?????????.com');
 }

 

Yet to be tested!

[Guest]

http://www.oscommerce.com/forums/index.php?s=&...st&p=908651

[WS Evolution]

http://www.oscommerce.com/forums/index.php?s=&...st&p=908651

 

Perfect just the answer I was looking for. Thanks Mark :D

 

For those who read this post try changing the HTML href link wrapper function to:

 

 

  function tep_href_link($page = '', $parameters = '', $connection = 'NONSSL', $add_session_id = true, $search_engine_safe = true) {
global $request_type, $session_started, $SID;
if( tep_session_is_registered('customer_id') ) {
  $connection = 'SSL';
}

 

Found at the top of includes/html_output.php

[WS Evolution]

Perfect just the answer I was looking for. Thanks Mark :D

 

For those who read this post try changing the HTML href link wrapper function to:

  function tep_href_link($page = '', $parameters = '', $connection = 'NONSSL', $add_session_id = true, $search_engine_safe = true) {
global $request_type, $session_started, $SID;
if( tep_session_is_registered('customer_id') ) {
  $connection = 'SSL';
}

 

Found at the top of includes/html_output.php

 

 

If you have modified function tep_href_link try just adding the following at the top of the function:

 

 if( tep_session_is_registered('customer_id') ) {
  $connection = 'SSL';
}

 

Works perfect :)