Ssl – HTTPS on relative URLs

httpssslurl

I just installed an SSL certificate on my site to protect a registration page that I have, but I'm trying to figure out how to get the "https" in my URL.

I have created a template in Dreamweaver with my header and footer, and a space for my body content. Each of the links on the template are relative paths: /home.html, /register.html, etc.

So how do I get the https on my registration page? Furthermore, when the form is submitted, it directs the user to register.php where the user's information is actually submitted to the database. Does https need to be used on both pages? How do I add it in this case?

Best Answer

So how do I get the https on my registration page?

Assuming that you can't update all the links (which would be the prefered method) replace the existing page with one which redirects to the https url (or change the webserver config). Obviously this won't work for anything which POSTs to the URL - you'll need to switch to https earlier.

Does https need to be used on both pages?

Technically, you don't need the page with the form to be secure to ensure that the submitted data is sent over SSL - but:

1) the redirect method above won't work - the redirect is a GET operation - and you've already sent the data over http

2) as a user I'd be rather concerned about entering my details on a non-secure page

Correct way in new versions of nginx

Turn out my first answer to this question was correct at certain time, but it turned into another pitfall - to stay up to date please check Taxing rewrite pitfalls

I have been corrected by many SE users, so the credit goes to them, but more importantly, here is the correct code:

server {
       listen         80;
       server_name    my.domain.com;
       return         301 https://$server_name$request_uri;
}

server {
       listen         443 ssl;
       server_name    my.domain.com;
       # add Strict-Transport-Security to prevent man in the middle attacks
       add_header Strict-Transport-Security "max-age=31536000" always; 

       [....]
}

Best Answer

Related Solutions

nginx HTTPS – How to Serve HTTPS with Same Config as HTTP

NGINX Redirect – How to Rewrite All HTTP Requests to HTTPS While Maintaining Sub-Domain

Correct way in new versions of nginx

Related Topic