Site is using SSL but gets error in debug log.

[shendy-a8c]

Describe the bug

Site is using SSL but sees Stripe Payment Request live mode requires SSL. error in debug log. Forum thread is here.

To Reproduce I can't reproduce on my test site but I am guessing user's site might be behind load balancer.

Expected behavior If website is using SSL, plugin shouldn't throw Stripe Payment Request live mode requires SSL. error.

Environment (please complete the following information):

• WordPress Version: unknown.
• WooCommerce Version: 5.4.1.
• Stripe Plugin Version: 5.2.3.
• Browser [e.g. chrome, safari] and Version: unknown.
• Any other plugins installed
  • Easy WP SMTP Version 1.4.6.
  • EU Cookie Law Version 3.1.6.
  • German Market Version 3.12.
  • My Custom Functions Version 4.49.
  • Safe SVG Version 1.9.9.
  • WooCommerce PayPal Payments Version 1.3.2.
  • Yoast SEO Version 16.4.
  • Theme is DIVI Version 4.9.6.

Additional context Not sure if user's site is behind load balancer or not but per is_ssl() reference page, that check might not work if behind load balancer.

More over, woo's way to check if store is using secure connection is by checking if store URL starts with https: https://github.com/woocommerce/woocommerce/blob/trunk/includes/rest-api/Controllers/Version2/class-wc-rest-system-status-v2-controller.php#L1158.

[billrobbins]

For a bit more information, I did install Query Monitor and it shows that is_ssl() is true for product pages.

[ricardo]

@billrobbins is that website logging Stripe Payment Request live mode requires SSL.?

[billrobbins]

Hey @ricardo it did log that error several times even while the site was loading via HTTPS. They were eventually able to get Apple Pay to load by deleting the site from the Stripe dashboard and then manually adding it back in there.

Every time they would trigger its creation from inside the WC settings it would fail. Once they manually added it, the button worked without issue.

[AashikP]

Just noting that user in 4094572-zen added the recommended code snippet in the forum thread linked above, which didn't fix the problem with Google Pay in HK returning billing area compulsory error even though the logs don't display the SSL error at the moment:

if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https')
    $_SERVER['HTTPS'] = 'on';

[aheckler]

4367478-zen, though my understanding is that this is probably due to a server or load balancer configuration, not so much anything wrong with our code?

[aheckler]

4650405-zen is this.

[aheckler]

The user in 4650405-zen thinks that this might be due to some WP cron job using HTTP. That theory led me here:

https://github.com/woocommerce/woocommerce-gateway-stripe/blob/develop/includes/abstracts/abstract-wc-stripe-payment-gateway.php#L1729-L1765

Maybe we should add another check there for DOING_CRON? cc @zmaglica

[ricardo]

As we received a follow up from 4650405-zen - p1642308955053900/1640857483.018700-slack-C7U3Y3VMY

Apparently the problem is generated by search engine bots crawling the site over HTTP.

Since they don't have an automatic HTTP to HTTPS redirection rule on their server, whenever a bot crawls a HTTP product page, Stripe will generate that log. Stripe not only runs on checkout, but also on product pages to support express payment methods such as Apple Pay.

Ultimately, the issue lies on their server allowing HTTP access. They could add a permanent redirect (301) from HTTP to HTTPS to fix the problem. This is also important to prevent users from trying to checkout over HTTP.

[csmcneill]

4788261-zen, recommended forcing HTTPS

[csmcneill]

In 5174939-zen, the user is seeing a similar error with WCPay on an AT site.

[theabhig]

Same error on another AT site in 5769175-zen

[csmcneill]

5779447-zen