joshkoenig / pantheon-secure-login

Pantheon secure login (SSL for authenticated users)
GNU General Public License v2.0
3 stars 5 forks source link

Redirect Loops #6

Open gmclelland opened 10 years ago

gmclelland commented 10 years ago

Thank you for this module. I'm not sure yet what is causing it, but I just wanted to let you know that I'm seeing redirect loops on the different sites that I'm trying to use this module on.

gmclelland commented 10 years ago

Little more information for you.. If I clear out the "Standardize my live traffic on a standard domain name." field, the redirect loops stop and everything seems to start working correctly.

Should this block of code check if the user is NOT browsing /user/login starting on line 49?

if ($live_fqdn !== '' && $live_fqdn !== $_SERVER['HTTP_HOST'] &&
          $user->uid == 0 && (arg(0) == 'user' && arg(1) == 'login')) {
        $location = 'http://' . $live_fqdn . $_SERVER['REQUEST_URI'];
        pantheon_secure_login_redirect($location, 3600);
      }

Maybe it should like: (psuedo code) If we are browsing the live-xxxx.gotpantheon.com site as an anonymous user then redirect all those request to the real domain unless we land on live-xxxx.gotpantheon.com/user/login? This should probably check for admin/* paths as well, right?

Maybe I don't fully understand what "Standardize my live traffic on a standard domain name." does? I assumed it would redirect anybody browsing your live-xxxx.gotpantheon.com site to be redirected to your real domain that way the live-xxxx.gotpantheon.com domain doesn't get indexed by search engines? Is that correct?

joshkoenig commented 10 years ago

Hey Glenn,

Thanks for the report!

You're correct about the intent of the "standardize live traffic" option, but it does indeed look like there's a bug there. I'll see if I can replicate this on my personal blog.

joshkoenig commented 10 years ago

Ok confirmed. My logic there's is precisely backward.

This is meant to be an exception for user/login so that you can hit that on the secure but not SEO friendly domain.

I'll get a pull request together to fix this shortly.

joshkoenig commented 10 years ago

Should be fixed now!

gmclelland commented 10 years ago

That looks like it did the trick. Thanks Josh