Redirect errors when forcing SSL

[bethperkins]

Please help - I have tried several methods of forcing SSL with a custom field as well as using a plugin and the page won't display because of a redirect loop. I have a valid SSL and IP address with my hosting company. website is www.Action-Intell.com. I was testing out a purchase screen at https://www.action-intell.com/membership-options

Page displays fine without the force of SSL but I get the IE error messages...

[bethperkins]

Would this info from Network Solutions be the cause of my problem?
"Our proxy SSL doesn't allow server-side variables to detect HTTPS (secure). All server-side coding will always detect HTTP (non-secure), and for programs that attempt to redirect non-secure connections (http://) to a secure connection (https://) will result in an infinite loop and server error after 30 seconds.

The only ways around this is to assume the connection is secure by making all the links to the sensitive pages https, or use a client-side program (like javascript) to detect if it's secure and redirect if it's not.

[PseudoNyhm]

I realize this isn't a particularly helpful response, but in my experience with hosting providers, a proxy SSL setup would be difficult to code behind. Can Network Solutions force all HTTP connections to your site to always go to HTTPS? This would make your entire site HTTPS, and your code wouldn't have to deal with it at all (and could treat everthing as plain HTTP).

[bethperkins]

I installed the Wordpress HTTPS plugin and I had the same redirect errors. In desperation I tried a solution on the plugin forum suggested by TomsRiver WebDesign and it is working. I'm not happy with this solution because I don't like changing plugin code (that I don't fully understand, and now I cant uprev). Here is the link for any other people suffering, try it out. http://wordpress.org/support/topic/plug ... irect-loop
In the meantime, please let me know if someone has a better solution.

[Jason Caldwell]

Thanks for your inquiry Beth.
~ and for your patience. I'm sorry, it's been crazy here the last few days.

Regarding SSL ...
When you set the Custom Field s2member_force_ssl -> yes, s2Member will force a redirection to the https:// version of the Post or Page. In addition, s2Member will append this onto the query string of the URL: ?s2-ssl=yes. So you can ditch the JavaScript solution if you like, and instead just add these two lines to the top of your /wp-config.php file, right after the <?php tag.

Code: Select all

<?php
if(isset($_GET["s2-ssl"]))
    $_SERVER["HTTPS"] = "on"; 

This way WordPress, s2Member, and other plugins know that you're running under the SSL protocol, whenever the URL contains /?s2-ssl=yes.

I hope that helps. If not, please let us know.

[Jason Caldwell]

I'm taking a look at your other question via email now.

[Jason Caldwell]

I just sent you an email with some private details regarding custom coding.

[bethperkins]

I don’t think you understood my SSL problem. I can’t use the “force SSL” option because the customers hosting company is Network Solutions.

You can try the page here, it goes into an endless loop:
http://www.action-intell.com/printers/?s2-ssl=yes

I did some research of the web – I put it in the note and the forum. This was what Network Solutions says:
"Our proxy SSL doesn't allow server-side variables to detect HTTPS (secure). All server-side coding will always detect HTTP (non-secure), and for programs that attempt to redirect non-secure connections (http://) to a secure connection (https://) will result in an infinite loop and server error after 30 seconds.

The only ways around this is to assume the connection is secure by making all the links to the sensitive pages https, or use a client-side program (like javascript) to detect if it's secure and redirect if it's not.

This is why I came up with a separate header.php for my check out. Can you tell me a way that I can let all the components of my check out page know that it is https without using the query string?

I will encourage customer to leave NS soon but I need to get this working right now,

[Jason Caldwell]

Thanks for the follow-up.

I think I do understand, but please correct me again if I really don't.

s2Member handles most of this for you. So as long as the client is using SSL for WordPress Posts/Pages that have the Custom Field s2member_force_ssl = yes, this solution should provide a simple workaround for you. I just tested this on your site. It seems to work nicely. No more endless loops, and all media is forced to SSL by s2Member.

/wp-config.php

Code: Select all

<?php
if(isset($_GET["s2-ssl"]))
    $_SERVER["HTTPS"] = "on"; 

* No need to use a separate header. s2Member handles all media conversions to https:// for you automatically. It does appear that your SSL certificate is invalid though? Or just in development still?

I don’t think you understood my SSL problem. I can’t use the “force SSL” option because the customers hosting company is Network Solutions.

I understand. But nothing prevents your /wp-config.php file from setting the proper environment variable when it detects ?s2-ssl in the URL. That's why this works. This is what Network Solutions *should* be doing, but they aren't, so we just have to force WordPress to do it instead of relying on the server to handle it automatically.

Code: Select all

<?php
if(isset($_GET["s2-ssl"]))
    $_SERVER["HTTPS"] = "on";  

[bethperkins]

My apologies - I've tried the force SSL so many times without success. I've been in two days of endless loops. I understood that S2Member should do all this for me but I had the conflict with NS and I didn't know about putting this code in the wp.config file.

I put the code in the file and it know converts files to shttp. But unfortunately, I still get security error messages and I checked JS debugger and there are two lines with HTTP in the javascript for State, Zip and US. One is an Ajax gif file

Thank you for your help and I would love to know how ti fix the issues with the javascript

[Cristián Lávaque]

Hi Beth. I saw the code you quoted in the other thread on this. viewtopic.php?f=4&t=14122

Could you try this hack?

/wp-content/mu-plugins/s2hacks.php

Code: Select all

<?php

add_action('ws_plugin__s2member_config_hooks_loaded', 'https_plugin_dir_url');

function https_plugin_dir_url() {
    if (isset($_GET['s2-ssl']))
        $GLOBALS['WS_PLUGIN__']['s2member']['c']['dir_url'] = strtr($GLOBALS['WS_PLUGIN__']['s2member']['c']['dir_url'], array('http:' => 'https:'));
}

?>

I hope it works and solves your problem.

[vonralls]

I'm still having this issue even after adding the lines to the wp-config and putting the custom field value: s2member_force_ssl and yes in the page. Is there anything else that could cause this? It looks like the page is trying to force ssl, but then redirects back to http...

[Jason Caldwell]

Hi Beth. Thanks for the follow-up.
Using the FTP information you provided, I can confirm that this hack inside the /wp-config.php file works.

Code: Select all

<?php
if(isset($_GET["s2-ssl"]))
    $_SERVER["HTTPS"] = "on"; 

However, given your hosting situation with Proxy SSL and no $_SERVER["HTTPS"] environment variable, I can see why you're continuing to have trouble. Although this hack corrects the endless loop, after our email communication the other day, I can see that it still does NOT fix the issue with embedded media that does not contain the ?s2-ssl parameter. I'm sorry, but I've been unable to find a workaround for this. I would recommend a hosting change in this case. Without the proper environment variables available to PHP, it makes it impossible for WordPress, and thus s2Member to know when SSL is and is not enabled. I suggest MediaTemple (gs).

[vonralls]

I have added the above code to my wp-config file, and I have added the s2member_force_ssl custom field set to yes on the page. I still get the redirection issue. In Safari, I can watch it go back and forth between http: and https: until it dies with the redirect error.

[Jason Caldwell]

I have added the above code to my wp-config file, and I have added the s2member_force_ssl custom field set to yes on the page. I still get the redirection issue. In Safari, I can watch it go back and forth between http: and https: until it dies with the redirect error.

Does this happen in other browsers, or just Safari?
Do you have anything special related to redirection inside your .htaccess file?

[vonralls]

.htaccess looks like this:

Code: Select all


# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress




Yes, happens in IE, Chrome, and FF as well.

[Jason Caldwell]

What other plugins are you running in concert with s2Member?
It sounds like there is another plugin and/or theme that is working in conflict with s2Member?
Can we get a link to this page please?

[vonralls]

I will try to make a list. http://www.sms-midsouth.org
Click "membership" then click "Register Now" under one of the packages to see the problem.

[Jason Caldwell]

I will try to make a list. http://www.sms-midsouth.org
Click "membership" then click "Register Now" under one of the packages to see the problem.

Great thanks. I was able to reproduce the infinite redirection loop. Yea, that's ODD. I've been unable to reproduce this on our end though, so I suspect it's something server-specific. If I can see the list of other plugins, that might shed some light.

[vonralls]

Here you go:

akismet
contact form7
event espresso
event espresso calendar
event espresso members add-on
exclude pages from navigation
nextgen gallery
page links to
redirection
s2member
staff directory
twitter widget pro
wordpress importer

Wordpress HTTPS is deactivated, but was installed

[vonralls]

Additionally, it seems to me that I should be able to add https: to any page and it should work. If I just go to the main page with https://www.sms-midsouth.org it redirects back to http://... Interesting.

[vonralls]

I believe the problem is the Espresso Event plugin. There is an SSL switch in that plugin, and when it is turned off, SSL works for the rest of the site. When it's on, it breaks SSL for the rest of the site.

[Jason Caldwell]

I believe the problem is the Espresso Event plugin. There is an SSL switch in that plugin, and when it is turned off, SSL works for the rest of the site. When it's on, it breaks SSL for the rest of the site.

Ah, thanks for reporting this. I'll add this plugin to our list here: viewtopic.php?f=36&t=6309

In the mean time, if the developer is unable to resolve the issue for you, please ask them to send us a copy of the software so we can help to resolve this. They can use this private contact form: http://www.s2member.com/contact/

[dvpro]

This is still a problem with Event Espresso 3.1. Has anyone at EE responded?

[Jason Caldwell]

Thanks for the follow-up.

This is still a problem with Event Espresso 3.1. Has anyone at EE responded?

No, I'm sorry. There has been no communication on this issue that I'm aware of.