Strange fallback to http URLs

[LeBenLeBen]

I have a multilingual website running on Kirby 3 that uses this plugin and recently got a weird issue on production where the URLs of assets (both CSS and JS) loaded through Fingerprint were using http and not https whereas the website being served only over SSL.

For some reason this was happening only on the landing page, it was working properly on all the others. Also I remember it working fine at some point and don't really know why it suddenly started to fail.

I was able to fix the issue by specifying bnomei.fingerprint.ssl to true on production but it's weird since it works perfectly fine on my staging environment which is also SSL-only.

I'm using Kirby 3.1.2 and Fingerprint 2.3.1 by the way.

If I understand correctly it seems to be Kirby’s job to handle the URLs generation but apparently you had to add the SSL transform and I'm not sure why. For me the URLs should be protocol agnostic //domain.com/… to ensure it works everywhere without triggering cross-protocol issues and also to avoid an extra plugin setting.

Let me know if I can provide you more information to help you debug this.

[bnomei]

the bnomei.fingerprint.ssl option exists to enforce the "https-everywhere"-idea even on external urls that are handled by fingerprint but not generated by kirby.

the multilingual setup should not interfere afaik but not clearing the cache between staging and live enviroment could. most reasonable explanation is that your landing-page was available without the https protocol at least once. try

• disabling the ssloption, clear the cache and access page with http, check fingerpint urls
• repeat same step using https directly (avoiding redirects from htaccess), check fingerprint urls

[LeBenLeBen]

I was indeed able to access the website through http, for example with wget. This outputed assets URLs with http in the kirby pages cache and broke all further accesses through https.

Since the same cache is used whatever the protocol is, I still believe URLs without protocol would be the solution that works for the most. Is that something you manage on your side or is it a Kirby thing? I'm not sure if this problem would also occur without your plugin or not.

Thanks for the tips by the way!

[bnomei]

i am using the css/js helpers and $file->url() – both using kirbys core to detect the scheme.

imho the proper solution on your end would be: if you have SSL you should use your htaccess (or nginx config) to serve all resources with https. you can find some useful tips here: https://github.com/h5bp/server-configs-apache

[bnomei]

please test again with new major version. you might need to remove and require again with composer.