Moodle - SSL and non-SSL

[localzuk]

Another little issue with our Moodle setup.

 

We have SSL enabled for login with Moodle, but disabled for the rest of the site - so once someone has logged in, they receive the http:// version.

 

However, if someone goes to https://moodle.domain they end up with a semi-loading page - as browser security won't load the http info by default.

 

Also, some modules are sending people to https:// versions of internal links.

 

I don't want the entire site to be HTTPS only - this disables caching and I simply haven't currently got the time to figure out scaling everything to handle it.

 

How do I get the site to use the correct http/s in the correct places?

[penfold_99]

I can send you a snippet of code you can add to your config.php will set the $CFG->wwwroot correctly when viewed over http or HTTPS.

[localzuk]

I've bitten the bullet and switched the entire site over to forced SSL, and will deal with the extra server load if/when it appears!

[mjk]

I've bitten the bullet and switched the entire site over to forced SSL, and will deal with the extra server load if/when it appears!

 

^ thought server your risk assessment would have suggested SSL would be a good idea on anything displaying student information :-)

[localzuk]

^ thought server your risk assessment would have suggested SSL would be a good idea on anything displaying student information :-)

 

Indeed. Which is one of the reasons I've switched it on!

[mrverrall]

I don't want the entire site to be HTTPS only - this disables caching

 

I don't think this is true. You'll get a sight overhead for the actual encryption, but both client and httpd should continue to cache just the same as always.

[localzuk]

I don't think this is true. You'll get a sight overhead for the actual encryption, but both client and httd should continue to cache just the same as always.

 

Moodle are clear on this one, https disables http caching - https://docs.moodle.org/28/en/Apache#SSL

 

Its why they still recommend that people don't do whole site ssl.

 

Not that it matters though - as I've decided to just live with the extra demands on the server.

Edited May 12, 2015 by localzuk

[mrverrall]

Moodle are clear on this one, https disables http caching - https://docs.moodle.org/28/en/Apache#SSL

 

Unfortunately that information is WILDLY out of date!

 

HTTPS/SSL caching was addressed in Moodle 2.3, specifically https://tracker.moodle.org/browse/MDL-32683

 

Regarding SSL client caching some interesting background information to he found here, https://blog.httpwatch.com/2009/01/15/https-performance-tuning/ specifically 'Tip #3'.

 

Basically you are fine if you have a modern browser (Better than Firefox 3 or IE6) and a Moodle version above 2.2

 

I'll see what I can do about getting those pesky moodle docs updated.

[secretlife]

mrverrall -do feel free to log in and update those docs - if you do the 2.8 one I'll do the 2.9 one - I'm not confident enough about what you are talking about to do it myself but I'll copy and paste what you say:)

[mrverrall]

mrverrall -do feel free to log in and update those docs - if you do the 2.8 one I'll do the 2.9 one - I'm not confident enough about what you are talking about to do it myself but I'll copy and paste what you say:)

 

Fixed

[nickjelly]

Does this apply to IIS servers running Moodle as well? I noted the Moodle doc page edited was about Apache configuration.

[mrverrall]

To the best of my knowledge it should apply to any HTTPD as it is PHP setting the cache-control header and the users browser acting on it, IIS is just the piggy in the middle.