Forum OpenACS Q&A: how to force/redirect to https?

Hi all,

I'm using OpenACS 5.6 on AolServer 4.5.1 and I need to force to https always, not only for the login and admin pages. How can I force https redirection?

Thanks in advance

Collapse
Posted by Benjamin Brink on
Emmanuelle,

Try setting the RestrictToSSL parameter for the main subsite instance at /admin/site-map to: "/*" (without quotes).

cheers,
Benjamin

Collapse
Posted by Benjamin Brink on
You might also have to have the kernel parameter ForceHostP set to 1.
Collapse
Posted by Emmanuelle Raffenne on
Hi Benjamin,

I've tried that and it wouldn't work. Then, reading your answers, I realized that probably I need to restart the server so the redirection would be effective and, yes, that was it 😊.

So finally, I've set RestricToSSL to "*" for the main site, without the leading slash otherwise it wouldn't work. I didn't need to set ForceHostP to 1.

Thanks for your help.

Collapse
Posted by Jim Lynch on
Heya Emmanuelle,

Curious, why would one choose to not set ForceHostP? Why choose to set it?

-Jim

Collapse
Posted by Benjamin Brink on
Jim,

ForceHostP keeps the domain consistent between pages, so there are no issues with services generated from cookies, such as sessions when switching between www.domain and domain for example.

cheers,