Force http or https using JS for those who dont know how

Legoman99573

I know it sounds weird and im new to this community and give it high hopes as it seems to have more potential than Discourse, but I used a code from an open source buddy and showed me how to force http or https so if someone messes up it wont look bad on the user.

Place under Appearance/Edit Custom Header and it

Below forces https:

<script>
    if (window.location.protocol == "http:") {
      console.log("You are not connected with a secure connection.")
      console.log("Reloading the page to a Secure Connection...")
      window.location = document.URL.replace("http://", "https://");
    }

    if (window.location.protocol == "https:") {
      console.log("You are connected with a secure connection.")
    }
</script>

Below forces http:

<script>
    if (window.location.protocol == "https:") {
      console.log("You are not connected with the correct protocol.")
      console.log("Reloading the page to the correct protocol...")
      window.location = document.URL.replace("https://", "http://");
    }

    if (window.location.protocol == "http:") {
      console.log("You are connected with the correct protocol.")
    }
</script>

Tell me if this helps your forums or not. These force the protocol and if you went to http://discuss.flarum.org/, you would be redirected to https://discuss.flarum.org/ instead. IK some know this, but this should be helpful to those who don't know about it yet.

console.log is not needed, but is useful for those who are curious why it happens when they try to use a protocol and can be a useful extension once i learn more on how to make extensions here.

bundet

Legoman99573 hi bro nice code, very clear, i am indeed looking for alternative redirect https to http for static pages like a blogger, and that solution when i get lost in this forum hehehe thank you ?

clarkwinkelmann

Nice, but is there any actual benefit over using standard HTTP redirects ? I know HTTPS redirects for static websites (like GitHub Pages) can be a real pain and require javascript, but with Flarum you usually control the webserver (or if you don't HTTPS should really be your host default)

Also, if returning users type the http address of your forum, they will expose their cookies over unencrypted connection before being redirected ?

And of course, any attacker can remove your redirect code through a man-in-the-middle attack. With permanent HTTP redirect (and HSTS, but if you do JS redirect I think there's little chance you use that) subsequent visits starting with HTTP will automatically be redirected. With your code each subsequent HTTP visit (like typing your hostname in the address bar) will first go unencrypted, leaving a chance for MITM attack.

luceos

clarkwinkelmann Also, if returning users type the http address of your forum, they will expose their cookies over unencrypted connection before being redirected

I don't think that cookies set under https are available under http.. It would depend on your setcookie arguments though.

I think a force https option in the admin would make sense.

Legoman99573

If you set http when the site is https, the console loads alot of errors, same as the other way around. The JS code makes it check the http:// and https:// in front.

For example:

http://randomsite.com/flarum/4-Test and you set it to load over https, it will simply reirect the site to https://randomsite.com/flarum/4-Test

Basically force a redirect so you don't see a mess when on the opposite protocol in the 'url' => 'https://randomsite.com/flarum', part of the config.php in flarum root. I could make it into an extension, but I will have to see how to make it check the url option in the config, if the API has that.

Legoman99573

bundet Just use the 2nd option ?

gashmicky

I would like to add this code but i wouldn't get the right file path so would you help me for this ? Thank you