Question

I understand how to force SSL on certain pages but how do I redirect other pages without https connection?

The reason is that I have external javascript and images running on other pages and they do not need to be secure but it gets redirected from my secure payment page with https and it creates padlock with red cross on it.

Thanks

Answer 1

The Cake Book has an example how to force SSL:

public function forceSSL() {
    $this->redirect('https://' . env('SERVER_NAME') . $this->here);
}

The forceSSL() function is used in a callback of the SecurityComponent that is called if a page is accessed without https.

There is no such callback the other way round, but SecurityComponent::requireSecure is an array of all actions that are https-only, if set up using the requireSecure() function.

So you can do something like this in your AppController:

public function beforeFilter(){
    // Check if current action is secure but shouldn't be
    if( 
        $this->request->is('ssl')
        &&
        !in_array($this->request->params['action'], $this->Security->requireSecure) 
    ){
        // Redirect to the http URL
        $this->redirect('http://' . env('SERVER_NAME') . $this->here);
    }
}