1

I have problems running typo3 (version 6.2.30 LTS) on my webhoster. The hoster uses an reverse proxy in front of the webspace which seems to forward all requests as normal http requests. The php-superglobal $_SERVER["HTTPS"], which would indicate the SSL connection, is not set. Typo3 uses this variable to determine whether itself is running under SSL or not. As the variable is not set, javascripts will be blocked by the browsers XSS filter. The site and the linked script will (correctly) not be considered to be from the same origin.

My question is whether I can configure typo3 in a way that enforces HTTPS regardless of the $_SERVER["HTTPS"] superglobal of php? or do I have to contact my hoster to request some change in the web-servers configuration?

1

It sounds like you are on shared hosting, which means you are not administering the system you use. This severely limits your options and it means that you will have to open a support ticket and ask your hosting company to set everything up for you.

There are two HTTPS connections at issue here: client browsers <--> web host's reverse proxy, and web host's reverse proxy <--> web server hosting your site. The first connection is the one causing you trouble but best practice would be to use HTTPS for both connections. You'll have to ask your hosting company if this is possible.

It may be worth switching web hosts to a different company that transparently proxies, so you do not have this problem. Another option may be to edit your CMS templates to include the JavaScript resources from a third-party HTTPS host. Common resources like JQuery are widely available on HTTPS CDNs and are easy to find, but custom JS for your templates will be a problem. You might even consider in-lining those. That isn't best practice but it may work.

Personally I think changing hosting companies is the way to go, especially if your current host wants to charge you extra to work around their proxy configuration, but there are a few things to try first.

  • Thank you @Tom, this is very helpful! I will ask the hoster to help me out there. As I work at an University Institution, changing the web hoster is probably not an option for me. – Marcel P Jan 24 '17 at 9:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.