Codeigniter with SSL not working

Question

I have tried most of the solutions for Codeigniter with SSL and none of them worked.

What I need is the whole website running under SSL, it's a website with a lot of forms and showing data from a database, like an admin section, so the only resources used are css, js, and some images, nothing else.

This is what I have in my config.php file.

$config['base_url'] = 'https://admin.example.ie/';

Main .htaccess

RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?/$1 [L]

order deny,allow
deny from all
allow from 86.XXX.XXX.XXX

application/.htaccess

Options -Indexes
Options +FollowSymLinks
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /

    #Removes access to the system folder by users.
    #Additionally this will allow you to create a System.php controller,

    RewriteCond %{REQUEST_URI} ^system.*
    RewriteRule ^(.*)$ index.php?/$1 [L]

    #When your application folder isn't in the system folder

    RewriteCond %{REQUEST_URI} ^application.*
    RewriteRule ^(.*)$ /index.php?/$1 [L]

    #Checks to see if the user is attempting to access a valid file,
    #such as an image or css document, if this isn't true it sends the
    #request to index.php

    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^(.*)$ index.php?/$1 [L]
</IfModule>
<IfModule !mod_rewrite.c>
    ErrorDocument 404 /index.php
</IfModule>

This works partially.

This is the var_dump($_SERVER) when accesing the homepage.

["FCGI_ROLE"]=> string(9) "RESPONDER" 
["HTTPS"]=> string(2) "on" 
["SSL_TLS_SNI"]=> string(28) "admin.example.ie" 
["HTTP_HOST"]=> string(28) "admin.example.ie" 
["HTTP_USER_AGENT"]=> string(72) "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:27.0) 
["HTTP_CONNECTION"]=> string(5) "close" 
["SERVER_SIGNATURE"]=> string(74) " Apache Server at admin.example.ie Port 443" 
["SERVER_SOFTWARE"]=> string(6) "Apache" 
["SERVER_NAME"]=> string(28) "admin.example.ie" 
["SERVER_ADDR"]=> string(15) "XXX.XXX.XXX.XXX" 
["SERVER_PORT"]=> string(3) "443" 
["REMOTE_ADDR"]=> string(11) "86.XXX.XXX.XXX" 
["REMOTE_PORT"]=> string(5) "58332" 
["GATEWAY_INTERFACE"]=> string(7) "CGI/1.1" 
["SERVER_PROTOCOL"]=> string(8) "HTTP/1.1" 
["REQUEST_METHOD"]=> string(3) "GET"

So as I can see SSL is working here. However if I put my login and password(the homepage is only an login page) and go to the home page for logged users I lose the secured connection.

["FCGI_ROLE"]=> string(9) "RESPONDER" 
["REDIRECT_STATUS"]=> string(3) "200" 
["HTTP_HOST"]=> string(28) "admin.example.ie" 
["HTTP_USER_AGENT"]=> string(72) "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0" 
["HTTP_CONNECTION"]=> string(5) "close" 
["SERVER_SIGNATURE"]=> string(73) "Apache Server at admin.example.ie Port 80" 
["SERVER_SOFTWARE"]=> string(6) "Apache" 
["SERVER_NAME"]=> string(28) "admin.example.ie" 
["SERVER_ADDR"]=> string(15) "217.XXX.XXX.XXX" 
["SERVER_PORT"]=> string(2) "80" 
["REMOTE_ADDR"]=> string(11) "86.XXX.XXX.XXX" 
["REMOTE_PORT"]=> string(5) "58392" 
["REDIRECT_URL"]=> string(15) "/employee/home" 
["GATEWAY_INTERFACE"]=> string(7) "CGI/1.1" 
["SERVER_PROTOCOL"]=> string(8) "HTTP/1.1" 
["REQUEST_METHOD"]=> string(3) "GET" 
["REQUEST_URI"]=> string(15) "/employee/home"

Any ideas on why is this happening. We can hand over this project to the client with this security breach.

Lee Salminen · Accepted Answer · 2014-03-31 14:34:52Z

1

RewriteEngine On
RewriteCond     %{HTTPS} !=on      
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Try adding that to the top of your htaccess, before the other rules.

Don't duplicate the RewriteEngine On

Also, how are you constructing URLs and form actions in your app? I would use <a href=/secure_page> instead of <a href=http://page>.

answered Mar 31, 2014 at 14:34

Lee Salminen

8808 silver badges18 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

bucur89 Over a year ago

Hi Lee,it worked partially. In the employee controller the home method has a var_dump($_SERVER) at the beggining, and at the end loads the default view. The var_dump showed the SSL being used but a few moments later it loaded a screen saying: Firefox has detected that the server is redirecting the request for this address in a way that will never complete. It doesn't make much sense to me.

bucur89 Over a year ago

To construct the links I use: redirect('/employee/home/', 'refresh'); anchor('employee/clients', 'Review clients', array('class'=>'view_client')); form_open('employee/home/')

bucur89 · Accepted Answer · 2014-04-01 15:02:34Z

1

I was tired of trying to fix this problem so I started with a fresh CodeIgniter installation, it worked.

With the base_url as

$config['base_url'] = 'https://admin.example.ie/';

everything worked, and I rebuilt the website using the pieces of code. Now everything works perfect and I check ports and https status on everypage to check that everything is ok.

answered Apr 1, 2014 at 15:02

bucur89

1701 silver badge15 bronze badges

Collectives™ on Stack Overflow

Codeigniter with SSL not working

2 Answers 2

2 Comments

Comments

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Related