Security Warnings & Secure/Non-Secure Forms

[emdub]

I've spent a week going back and forth with MIVA support on this issue, and finally I was advised to try the user forums because the support technician was unable to find a solution.

Summarizing the important parts:
During some testing, I noticed that I get security warnings when adding items to the cart when logged in:

"Although this page is encrypted, the information you have entered is to be sent over an unencrypted connection and could easily be read by a third party.

Are you sure you want to continue sending this information?"

I was eventually able to narrow the issue down to the form action for the "Add to Cart" button going to a non-secure url from a secure page. I use MIVA's seo shortlinks ( for example ../category/&mvta:cattree_category:code;.html or ../product/&mvta:product:code;.html). With this setup, if you're on a secure url, when you click one of these links, you will stay on a secure url, if you're not on a secure url, it will stay non-secure. The issue is that the form action always uses a non-secure url, no matter what. (

using this code: <form method="post" name="FORM" action="&mvt:global:sessionurl;">).

The best advice that they could give me was to stop using seo shortlinks all together (since doing that passes the session id when going from secure to non-secure) and go back to this format:

<a href="&mvt:global:sessionurl;Screen=PLST&Store_Cod e=&mvt:global:Store_Code;"><img src="graphics/00000001/productlist.gif" alt="Product List" border=0></a>

Is there really no way to make the form action go to a secure url from a secure page, and a non secure url from a non secure page? From what I can tell this would fix everything (would that open some hole security?).

[ILoveHostasaurus]

Re: Security Warnings &amp; Secure/Non-Secure Forms

What links are your customers clicking on to get back to the shopping after logging in? Can you just force those to http:// url to put them back on an insecure url for shopping?

Please private message me the ticket number too if possible.

[emdub]

Re: Security Warnings &amp; Secure/Non-Secure Forms

From the account page, they still have the entire category tree, plus the product list link in the navbar.

(also, PM'd)

[nottheusual1]

Re: Security Warnings &amp; Secure/Non-Secure Forms

I had the same issue and ended up forcing all links to http that didn't ever need to be https. It seems relying on the base HREF and using relative links does it when the base HREF becomes secure.

[emdub]

Re: Security Warnings &amp; Secure/Non-Secure Forms

How did you force your links to http? Did you just put your full url in instead of using relative links?

[nottheusual1]

Re: Security Warnings &amp; Secure/Non-Secure Forms

Yes - we only use relative links on images.

[RayYates]

Re: Security Warnings &amp; Secure/Non-Secure Forms

I'm sure David at Hostasaurus can fix this or tell you how to fix it.

Without seeing the site I can't be more specific but this may help.

1. But in general make all link <a href""> ALWAYS use the appropriate prefix. href="http://" or href="https://"
NEVER use just href="/SFNT.html"

2. Make sure images NEVER use http:// <img src="path/image.jpg">

3. Make sure your forms are using the correct variable.
<form action="&mvte:global:secure_sessionurl;"
<form action="&mvte:global:sessionurl;"

If your form is on a secure page using &mvte:global:secure_sessionurl; and you direct the user to a non-secure page
like the storefront <input type="hidden" name="Screen"value="SFNT">
The landing page will be delivered in secure mode "https://"

If you followed steps 1 and 2 this won't usually matter HOWEVER if you have JavaScript or links to external sources callined using "http://", you will get the dreaded security error. For example( src=http://google.com )

There are several work-a-rounds for this. The simplest is to wrap you links to external sites in a conditional.

<mvt:if expr="g.secure">
src=https://google.com
<mvt:else>
src=http://google.com
</mvt:if>

More complex methods involve redirection in some form. It's possible to force your landing page to always be delivered http:// in the .htaccess file and there are 302 redirect tricks with Toolbelt or toolkit and JavaScript tricks to force http://

[emdub]

Re: Security Warnings &amp; Secure/Non-Secure Forms

I was finally able to track down all the offending links, and everything seems to be working properly now. Thanks nottheusual1 and RayYates!

[lesliekirk]

Re: Security Warnings &amp; Secure/Non-Secure Forms

On a side note to this - if you use LiveHelp and have custom images, make sure you let LiveHelp know the images are going to be used in both secure and non-secure pages. If not, they will serve the image up non-securely - even if you insert the js file with a https reference.

Leslie