Secure forms and SSL

Okay so:

That refresh / redirect process is exactly what is supposed to happen.That’s actually mautic doing the step of clearing the cache for you.

Next question: did you complete the step of adding the ‘true’ to the index.php file from my previous note? I think what that will do is switch mautic to dev mode, so the prod logger file won’t be used anymore, and it could possibly be messing with the cache of the config! It definitely should be doing that redirect process.

Finally - if that doesn’t work, we can just manually put your mail settings into the local.php config file and clear cache, that should basically force it to be correct.

Hi Chad,

Sorry for a few days radio silence on this one, but a few things going on. The correct settings are in the config file, which shows the Mandrill account as wmb@abelard-uk.com and the correct API key.

Mautic is not sending any emails now at all,

On the configuration screen it shows no API key and just womb in the account field which is wrong.

If I change them it doesn’t save them, and doesn’t test out as correct and doesn’t send a test email., so for some reason this is really odd…

Any ideas. Should we start from scratch with a new install?

I’ve tried a new install and I get all the same symptoms.

I’ve set the URL to https, but if you just load the system it loads http.

Forms are sent as insecure - which makes it unusable in a secure site.

If you force load https by typing that into the URL it appears to load but no configuration changes will save.

There must be something simple that I am missing, but I can’t work out what it is.

Happy to share logins and FTP data with someone who knows what they are doing.

Regards

W

I’ve been trying a number of things with .htaccess and the security.php in config to try to force HTTPS but whatever I do is creating too many redirects.

So we are still at square one.

Hi Wbuist:

Can you send a screenshot of your configuration screen with the site paths?

Of course:

Hi guys,

I read back over the thread so forgive me if I missed something and am repeating Chad.

I think Chad suggested this but just wanted to confirm; did you try accessing Mautic itself directly via https, edit the form and resave? That should force Symfony to generate the form’s action URL as https as well. It currently will not automatically redirect to https if you access Mautic via http; although we should consider doing that based on what’s set as the Site URL in the configuration (that is currently mainly used for CLI functions).

As for the configurations save issues with mail; did that get resolved with 1.0.4? There was an issue with 1.0.3 that did not allow the config to correctly save on certain hosts.

Thanks,
Alan

Hi Alan,

Yes I did try that. I’ve even installed another instance of Maurtic and made sure that everythig was pointing at HTTPS from the get go, but the same symptoms

I really only ever want to access it through HTTPS - I don’t want the possibility of anything ever hitting the site via HTTP, but I can’t make that work, If i put redirect rules in the htaccess file or the security config I just get too many redirects, which suggests that somewhere there’s something pushing back to HTTP that’s probably at the root of all this.

As far as I know, there’s nothing in Mautic that will force http or https. It’ll use whatever you access the URL with.

I added the following to my Mautic’s root .htaccess and I was redirected to https://my-mautic-url.com without issues. Could there be something else configured on the server that could cause the redirect loop? Is this a VPS or shared host? If a VPS, is there anything in your virtual host config that could cause it?

RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

I also verified the form’s action is generated as https as long as I saved the form when accessing Mautic through https://my-mautic-url.com. (i.e. https://my-mautic-url.com/s/forms/new)

When you accessed Mautic through https (manually typing https:// into the address bar), does it cause the redirect loop? Or is that only when you add something to your .htaccess to force https?

Asking because based on your screenshots of the config, it looks like its being accessed via http as otherwise Chrome should be showing something like

Thanks!
Alan

Hi!

So the email/password issue looks like it’s the browser auto-injecting saved credentials into those fields. We’ll add the appropriate attributes to the inputs to prevent that in the next version. In the mean time, it seems that you either need to delete the credentials from your browser’s saved passwords (for Safari -> Preferences -> Passwords; Chrome -> Preferences -> Show Advanced Settings -> Passwords and Forms -> Manage Passwords), or be sure they are removed/reset before saving the configuration.

I watched your screencast from earlier and that’s what clued me on on that. When you first open the configuration, you should be seeing something like:

But your’s has the solid stars in the password box when first loading the config which says that it has text inserted.

As for the SSL issue; I’ve not seen https affecting being able to login. If you need to reset your password and the config has your browser’s injected credentials saved, manually edit local.php to fix the mailer_username and mailer_password fields. Then delete the folder app/cache/prod. Refresh the login page then try the forgot your password again.

Your screencast shows that you are accessing https in Safari. But the chrome screenshots of your config is via http. Make sure that you are manually browsing to https:// unless you have added something to your .htaccess to force https.

Thanks!
Alan

Hi Alan,

Yes quite, it looks like it’snot https, and that’s the issue. Why isn’t it.

There’s something very odd going on and it may be down to my ISP. When I log on under https the settings for mail show as ‘wmb’ not ‘wmb@abelard-uk.com’ and if course it doesn’t show the password - but anyway under https I can’t save the settings so the username is just wrong.

When I tried to log in today under HTTPS my password didn’t work (I know I used the right one) and a password reset doesn’t work because it’s not sending mail anymore,

So now I can’t even access it from the front end.

Happy to give someone full access to any part of the set up to see if we can get to the bottom of the issue,

Hi Alan,

Thanks for this… I use safari as my principle browser. and I followed your instructions and removed all abelard passwords and then reloaded the pages and tried again, The same symptoms continued. Here’s a video to give some more clues I hope. I did this before removing the passwords from Safari, but afterwards the same things happened. Here’s the video…

http://www.screencast.com/t/etIbgOjfUMjJ

I hadn’t tried loading it in chrome before and when I did it worked perfectly (on the configuration elements anyway) so perhaps this is a Safari issue. - Odd…However, I’m pleased that we’ve beginning to hone in on something, On chrome though if I start from https at the login page it logs into the http version, If I amend the address in the URL bar it loads the HTTPS version and stays in it until I load the configuration page when again I have to manual edit the address, - That’s odd isn’t it?

I also did another video to look at the secure forms element after a lot more digging and I think I am getting somewhere with that too.

This is the original issue of forms note being secure even if they are originally created in HTTPS. The end result is that there is a workround but it’s not ideal, the javascript clearly calls HTTP in my case (and if I use the WP MAUTIC Plug in - it does too.

Anyway - Hopefully this is self explanatory.

http://www.screencast.com/t/NxaMPPFE3

Regards

William

William, did you ever find a solution to why the forms code did not generate a HTTPS URL?

It is a problem if there are insecure ways to reach your mautic installation, I’ve moved to a hosted Mautic and only use a secure domain to reach it. https://[instance].mautic.com rather than having my own self-installed instance.

What became clear was that if I saved a form in an insecure environment it remained insecure regardless of where it was called from. So having the possibility of an insecure access to the mautic instance raised the possibility of an insecure form in a secure environment later. So I removed any possibility of editing the form via HTTP and the problem was then resolved.

I do think there’s still an issue here and one option would be for the forms to include a parameter to force HTTPS regardless,

@ninjoan Have you sorted this issue? Have you tried re-caching your forms?

YEs @ces rebuild the forms.

Hello i just install a HTTPS and my Mautic form are not working i get a error messange that said some contend is not secure after a couple of hours checking i open the form url like this https://mydomain.com/marketing/form/7 and viw the source code and i find that the only thing that is not HTTPS is this,

<div id="mauticform_wrapper_testwordpress" class="mauticform_wrapper"> <form autocomplete="false" role="form" method="post" action="[b]http:[/b]//ninmedia.com/marketing/form/submit?formId=7" id="mauticform_testwordpress" data-mautic-form="testwordpress">
Who i fix this so far i made this change

  • i delete the App/cache folder
  • Change the url of my intance from http to https in configuration admin

Any idea?

This was a pain to resolve. I wrote this article which provides more detail on how to solve the problem. I will update it, as I actually expect more issues to emerge in the next day or two. Sorry it’s so long. There was a lot to do in order to get Mautic working after installing the SSL certificate.

https://e-marketing.com.au/marketing-automation-news/30-mautic-how-to-switch-to-the-https-protocol-ssl-certificate