Switch from https to http after login

There is an existing thread on this, but it is locked. Locked with no resolution, no replies, not one.

CB_Login's https setting doesn't seem to work, or I don't seem to understand what it is supposed to do.

The options are:

Option 1: Same as page (default)
Option 2: Use https for posting login and then same
Option 3: Use https (encrypted) for login and after login

Option 2... Is the https here not encrypted, as opposed to Option 3's? What is the meaning of "same"? Revert back to http, if the page browsed was http? "Same" as the "same" also in option 1? In contrast to Option 3, I would guess that users send passwords through https, but is bumped back to http after having successfully logged in. Unfortunately, that's not how it works!?

Option 3... This ones seems intuitive, and works as advertised. But given how Option 2 has "not quite worked", I have a nagging fear that Option 3 only "worked by accident, not by design". I'm worried I'm missing some security loopholes in using Option 3.

Is there an option where users are redirected back to http after logout?

Can someone tell me how this works before I dig into the code? Is the CBSubs and other paid packages having the same quality? I wish I can just buy CBSub and hit the ground running, but I'm afraid.

Is anyone having this same problem? Now I'm having another problem. Seems all compounded, and I don't know which problem caused what.

Login Redirection URL isn't working, no matter what I put in (absolute or relative).

I've since found Frontend User Access. If I still don't get a reply here, I'll hack CB_Login and move on. Sigh.

Option 2... Is the https here not encrypted, as opposed to Option 3's? What is the meaning of "same"? Revert back to http, if the page browsed was http? "Same" as the "same" also in option 1? In contrast to Option 3, I would guess that users send passwords through https, but is bumped back to http after having successfully logged in. Unfortunately, that's not how it works!?

This performs the login POST in HTTPS then redirects the user back to HTTP (can't make a POST to HTTP without cross content errors). This appears to be working as expected. The end user won't notice anything happening, but their data (username/password) is being passed to your site securely and they're then sent back as their previous usage. For example if they were browsing in HTTP they will be sent back to HTTP after login. If you've Firebug for Firefox and review the Net tab setting it to persist you should notice on login that the post is in HTTPS.

Option 3... This ones seems intuitive, and works as advertised. But given how Option 2 has "not quite worked", I have a nagging fear that Option 3 only "worked by accident, not by design". I'm worried I'm missing some security loopholes in using Option 3.

This is working exactly as designed.

Login Redirection URL isn't working, no matter what I put in (absolute or relative).

Please ensure CB login module is being used. Please also is in the format as seen in the below (relative and non-sef). Please also check if you've a first time login redirect configured in CB > Configuration > Registration as this would take affect for first time login which would override your modules login redirect. If you've multiple login modules please ensure you're using the module configured with the redirect.

index.php?option=com_comprofiler

krileon wrote:

Option 2... Is the https here not encrypted, as opposed to Option 3's? What is the meaning of "same"? Revert back to http, if the page browsed was http? "Same" as the "same" also in option 1? In contrast to Option 3, I would guess that users send passwords through https, but is bumped back to http after having successfully logged in. Unfortunately, that's not how it works!?

This performs the login POST in HTTPS then redirects the user back to HTTP (can't make a POST to HTTP without cross content errors). This appears to be working as expected.

No, it isn't working as expected. But I fixed it. CB v1.7.

krileon wrote:

Option 3... This ones seems intuitive, and works as advertised. But given how Option 2 has "not quite worked", I have a nagging fear that Option 3 only "worked by accident, not by design". I'm worried I'm missing some security loopholes in using Option 3.

This is working exactly as designed.

Yes, this one does work as expected.

krileon wrote:

Login Redirection URL isn't working, no matter what I put in (absolute or relative).

Please ensure CB login module is being used. Please also is in the format as seen in the below (relative and non-sef).

It's SEF-related. But I fixed it too.

Hey I am having the same problem you had - could you please let me know how you managed to get the redirect back to http and same page to work?