First off, disclaimer... I know what I'm asking for is against specification and recommendation but the boss wants it done. Having said that...

I'm the person responsible for a Moodle installation (open-source Learning platform), which is written in PHP, and served out using Apache on a Debian server. I was a Good Person™, and setup the site to serve itself out using HTTPS with our security certificates. This works great.

Next, the teachers get on and start uploading courses from a repository hosted by another company. That company's website only has HTTP, and refuses to add HTTPS capabilities, even with free certificates. The content is trying to load various images and iframes over HTTP, while the rest of the site is HTTPS; therefore, the user just sees big blank boxes on many courses.

To rectify this, I have been told to either turn off the security so our users won't complain about missing content (meanwhile, I'll get shamed by browsers), or else proxy the HTTP requests through the server so they load. I like technical solutions, so let's look at that.

I tried using Apache's SUBSTITUTE mod, but I could not get the effect I wanted. I wanted to replace src=http://badinsecureurl.com/... with src=https://myserver.issecure.com/proxy.php?http://badinsecureurl.com/..., but I couldn't get this working. As a test of the SUBSTITUTE module, I tried replacing div with vid. It did not change the contents, even after restarting Apache.

I'm assuming this is an issue in PHP. While I'd love to have a technical solution, the end-all goal is that users can click on courses, and see information linked from other sites showing up properly - whether the iframes load content from HTTP, or it somehow gets tricked into thinking it's HTTPS. I have control of my own server, but not the clients accessing the website, nor the remote server hosting random images required for the courses.

  • Wouldn't that expose your users to possible xss? Or are you expecting that your "won't https" host to protect themselves adequately? – Raystafarian Oct 4 '16 at 17:51
  • Under the direction of my manager, they do not care. I care very much, but I care much more about having a job. I understand the risks, and have his directions in writing saved externally, in case this comes back to bite me in the butt... What am I saying... WHEN this comes to bite me in the butt – Canadian Luke Oct 4 '16 at 18:03
  • Rough spot. I wish you the best of luck. Be weary of any regulations that may impose sanctions of "more than just lose your job" (e.g. US FERPA, COPPA) - Unfortunately that written paper only goes so far – Raystafarian Oct 4 '16 at 18:08
  • @Raystafarian Not in America, those laws won't affect us ;-) – Canadian Luke Oct 4 '16 at 18:09
  • Using mod_proxy_html (also back ported to apache v2.2) is probably the best way to fix the HTML being served by underlying proxied servers. – Unbeliever Oct 12 '16 at 13:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.