Question

If i visit the home page on my site (which uses code igniter) my homepage is using http,
Code igniter sets a cookie containing all the session info.

If I then click login, which is using https I get unsecure content warnings, and the only thing I can think of it being is the cookies as If I restart the browser then go straight to https://mysite.com/login then I get no unsecure content warnings.

How can I fix this (Note that the homepage cannot be https).

Answer 1

This error comes from content being served over http to a page that’s supposed to be https. For example, an <img>, <link>, or <script>.

The thing with Codeigniter is that it’s very likely you’re using base_url() or site_url() for full absolute URLs to the embedded content, probably using http.

Here are some things you can do:

1. Use relative URL’s, i.e. <img src="/path/to/images.jpg">

2. Don’t specify a protocol. Example: //example.com/path/to/image.jpg More on this technique here: http://paulirish.com/2010/the-protocol-relative-url/

3. In the __construct() of the controller that you need to use https (or in the method that needs it), load a different config file that redefines your base url to use https. Note that it will be too late for any scripts/libraries that use the base url for html output before this config file is loaded.

If you load the page in IE, you should get a very nagging error message that will give you a list of all the content that was delivered insecurely to help you troubleshoot (other browsers should have this feature as well, but in IE it’s especially prominent).

EDIT: Saw your note that there is nothing on the page being requested via http, only https, and the note about what happens when no cookies are present. My mistake, I just woke up – I should have read the question more thoroughly :p