1

I'm using the 'Security' component but I want to create a 'flag' for it (basically, so it's disabled locally and on the test server, but enabled on the live server). Here's what I came up with (to keep this example simple, we'll just apply it to the entire site in the AppController):

bootstrap.php:

Configure::write('enableSSL', false);

AppController.php:

public $components = array('Security');

public function beforeFilter() {
    parent::beforeFilter();

    $enableSSL = Configure::read('enableSSL');

    if(isset($enableSSL) && $enableSSL == true) {
        $this->Security->blackHoleCallback = 'forceSSL';
        $this->Security->requireSecure('shipping_billing', 'payment');
    }

}


function forceSSL() {
    // only redirect if they aren't viewing the site via https

    $enableSSL = Configure::read('enableSSL');
    if(isset($enableSSL) && $enableSSL == true) {
        if (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off' || $_SERVER['SERVER_PORT'] == 443) {

        } else {
            $this->redirect('https://' . $_SERVER['SERVER_NAME'] . $this->here);
        }
    }
}

However, with the above code, I get a 404 error when trying to visit certain pages (or submitting forms). Any idea why? I've checked the value of $enableSSL in both the beforeFilter/forceSLL and it is false). It has to do with including the component; if I remove all of the other code but keep the public $components = array('Security'); line, I still get the 404 page error...

1
  • When you include the security component, it will automatically use its CSRF features, which may be the source of the problems. With CSRF checks on, if you create a form using something other than Cake's form helper, or if you try submitting through ajax, the form will get rejected. It's hard to say though exactly what you can do to fix it without knowing more about those pages that aren't working. The easy way is just try disabling CSRF protection on those pages. book.cakephp.org/2.0/en/core-libraries/components/…
    – Kai
    Nov 27, 2013 at 16:38

1 Answer 1

0

I had the similar issue. My solution was to detect what kind of ssl auth was coming through. Here is my forceSSL method:

public function forceSSL($type) {

    switch($type) {
        case "csrf":
            // No cross form tampering, set flash, reload current window
            //$this->redirect('https://' . env('SERVER_NAME') . $this->here);
        break;
        case "auth":
            // Indicates a form validation error, or a controller/action mismatch error.

        break;
        case "secure":
            // Force SSL certificate
            $this->redirect('https://' . env('SERVER_NAME') . $this->here);
        break;
    }
}

It seems that is has to do with the csrf that causes problems with submitting. Finally my beforeFilter, I have arrays defined to what actions / controllers need ssl forced

    $this->Security->blackHoleCallback = 'forceSSL';

    if (in_array($this->params['action'], $this->secureActions) && in_array($this->params['controller'], $this->secureControllers) && !isset($_SERVER['HTTPS'])) {
            $this->Security->requireSecure();
    }

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.