Mobile app version of vmapp.org
Login or Join
Debbie626

: HTTPS with Typo3 behind a reverse proxy I have problems running typo3 (version 6.2.30 LTS) on my webhoster. The hoster uses an reverse proxy in front of the webspace which seems to forward

@Debbie626

Posted in: #Https #ReverseProxy #Typo3

I have problems running typo3 (version 6.2.30 LTS) on my webhoster. The hoster uses an reverse proxy in front of the webspace which seems to forward all requests as normal http requests. The php-superglobal $_SERVER["HTTPS"], which would indicate the SSL connection, is not set. Typo3 uses this variable to determine whether itself is running under SSL or not. As the variable is not set, javascripts will be blocked by the browsers XSS filter. The site and the linked script will (correctly) not be considered to be from the same origin.

My question is whether I can configure typo3 in a way that enforces HTTPS regardless of the $_SERVER["HTTPS"] superglobal of php? or do I have to contact my hoster to request some change in the web-servers configuration?

10.01% popularity Vote Up Vote Down


Login to follow query

More posts by @Debbie626

1 Comments

Sorted by latest first Latest Oldest Best

 

@Odierno851

It sounds like you are on shared hosting, which means you are not administering the system you use. This severely limits your options and it means that you will have to open a support ticket and ask your hosting company to set everything up for you.

There are two HTTPS connections at issue here: client browsers <--> web host's reverse proxy, and web host's reverse proxy <--> web server hosting your site. The first connection is the one causing you trouble but best practice would be to use HTTPS for both connections. You'll have to ask your hosting company if this is possible.

It may be worth switching web hosts to a different company that transparently proxies, so you do not have this problem. Another option may be to edit your CMS templates to include the JavaScript resources from a third-party HTTPS host. Common resources like JQuery are widely available on HTTPS CDNs and are easy to find, but custom JS for your templates will be a problem. You might even consider in-lining those. That isn't best practice but it may work.

Personally I think changing hosting companies is the way to go, especially if your current host wants to charge you extra to work around their proxy configuration, but there are a few things to try first.

10% popularity Vote Up Vote Down


Back to top | Use Dark Theme