• The plugin http-https-remover seems to be doing a great job so far.
    So thank you very much for creating it.

    I have a WP 4.8.4 multi-site installation working fine behind Haproxy as SSL terminator.

    I have been running into issues when trying to update plugins or themes in the WP admin console.

    
    load-scripts.php?c=1&load[]=jquery-core,jquery-migrate,utils&ver=4.8.4:4 Mixed Content: The page at 'https://mydomain.com/wp-admin/network/themes.php' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'https://mydomain.com/wp-admin/admin-ajax.php'. This request has been blocked; the content must be served over HTTPS.
    

    Looking at my wordpress 4.8.4 admin UI html source, I can see a large block of javascript with variables like

    var _wpUtilSettings = {
      "ajax": {
        "url": "http:\/\/mydomain.com\/wp-admin\/admin-ajax.php"
      }
    };

    as well as another variable

    
    var thickboxL10n = {
      "next": "Next >",
      "prev": "< Prev",
    ...
      "loadingAnimation": "http:\/\/mydomain.com\/wp-includes\/js\/thickbox\/loadingAnimation.gif"
    };

    .

    I have traced this down to
    https://github.com/WordPress/WordPress/blob/7c77266b9bb2f1882dd345a460f56f62a14bf0ed/wp-includes/link-template.php#L3206

    and most importantly to

    https://github.com/WordPress/WordPress/blob/7c77266b9bb2f1882dd345a460f56f62a14bf0ed/wp-includes/link-template.php#L3535

    Seems the wordpress internal code for retrieving URL still seems HTTP as that is what Apache is serving.

    Another interesting finding is is_ssl()
    at
    https://github.com/WordPress/WordPress/blob/aaf99e691391cfceb004d848450dbbf3344b1bee/wp-includes/load.php#L1034
    which is using $_SERVER['HTTPS']

    Maybe, we should also be checking
    _SERVER["HTTP_X_FORWARDED_PROTO"] for when we are behind a reverse proxy?

    Note that as I am behind a reverse-proxy, Apache running WP does it’s usual HTTP handling and does not deal with the HTTPS part of things.

    Any hint about how to fix this admin-ajax.php issue will be appreciated.

    Thank you very much.

    Arcadius

Viewing 1 replies (of 1 total)
Viewing 1 replies (of 1 total)
  • The topic ‘admin-ajax.php is still on HTTP causing mixed content issue’ is closed to new replies.