Mixed Content http about peregrine-cms HOT 6 CLOSED

Cris, thank you for reporting this issue . Is this in an author or publish scenario and are you using one or multiple servers behind the ELB?

from peregrine-cms.

This is in author mode. I'm using httpd on another instance between the peregrine instance and the ELB. When I access via http, everything seems fine. It might be a problem with the Authorization header. When the problem happens, the access.log at peregrine shows the request to /system/sling/info.sessionInfo from anonymous.

from peregrine-cms.

just wondering - are you using 2 authors behind the elb or just one? If you install an out of the box sling instance - do you see the same issue?

from peregrine-cms.

For now, I have taken httpd out of the mix. As of now there is only one author and one elb.
No I don't think Sling or Composum have exactly this same problem. When I log in direct to https:///bin/browser.html it will redirect after authn to http. But Sling and Composum still render when I request https URI's

I feel the problem relates to 302 sent from com.peregrine.admin.servlets.AccessServlet, which seems to be giving the location fully qualified location including http protocol. When the front end requests /perapi/admin/access.json it is handled by AccessServlet and redirected to http:///system/sling/info.sessionInfo

Since the application is behind an ELB or proxy that is terminating SSL, the location could be given with only the path like Location: /system/sling/info.sessionInfo which should allow the browser to use the protocol and domain inherited from the requested document.

from peregrine-cms.

I know this is not the best fix. But it avoids the problem and allows the app to render from https...

from peregrine-cms.

The current 'master' branch has a fix for this issue but it also contains other changes beside that.

from peregrine-cms.