2

I've run into a catch-22 with the search form that hopefully someone can help me with. From any of the secure pages in our Magento store (My Account, Checkout, etc) if you use the mini search form in the header, it takes you to a secure search results page https://oursite.com/catalogsearch/result. This results in a browser warning because there is unsecure content on that page. I thought I could fix this by modifying the CatalogSearch Helper class so that the getResultUrl functions always returns an http: link. However, this results in the browser warning you that you are about to send form data over a non-secure connection. So I can't seem to find a solution that doesn't look dangerous to the user.

Any ideas?

4 Answers 4

1

I know this is not the proper EAV/MVC/1000 lines of XML Magento module way of doing it, however, since this is a straightforward http/https problem you can put a couple of lines in .htaccess to get your search box behaving correctly:

RewriteCond %{SERVER_PORT} !^80$
RewriteRule ^catalogsearch http://www.example.com/catalogsearch/ [R=301,L]
2
  • This seems to work in my brief testing on my local server. I modified it a bit to be more generic: RewriteCond %{HTTPS} on RewriteRule ^catalogsearch http://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
    – Mageician
    Jul 14, 2011 at 14:42
  • ...and I think you have done a very good job of that generic re-write. @Joseph Mastey does have a good point - on page links should always be // (i.e. no http: or https: or even gopher: before it) for the page to auto-choose the right protocol for the page. This saves bytes, anyway, I am glad the 'hack' idea has been of use. Jul 14, 2011 at 14:48
1

The right way to fix this is not to use mixed content on that page. Magento can usually handle any page over HTTPS if it is requested to do so, so find the assets that are hardcoded over http:// and fix them to respect the current protocol properly.

1
  • Thanks, @Joseph Mastey, you're right that it's probably the "right" way to fix it. Unfortunately one of the offenders is a twitter follow button and twitter doesn't offer an https equivalent. I've tested the .htaccess rewrite rule in the second answer and that seems to work so I think I'm going to go with that unless you see any issue there. Thanks :)
    – Mageician
    Jul 14, 2011 at 14:40
0

For me the incorrect url got stuck in cache (we had heavy cache on the live server) and that caused the security warning for me. Hope this helps someone.

0

The question should be - why is this happening? Doing a search on a non-secure page will yield results on a non-secure page. After having visted a secure page, searching on a non-secure page will yield results on a secure page - how does this make any sense? What is the purpose of this?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.