How to correctly test if the url is under HTTPS with PHP
Most likely your application will be under a load balancer when in production. If you need to test if the url is HTTPS with PHP you will probably use env('HTTPS'), but under a load balancer that wont work.
You will need to check for HTTPXFORWARDED_PROTO server variable.
Off course testing this under your local environment can be painful, but here is a small tip that works wonders. Change your http-ssl.conf and on your virtual host add:
RequestHeader set X-Forwarded-Proto "https"
This will automatically add the HTTPXFORWARDED_PROTO on the response header from Apache to your app.
The same logic can be used for other Apache header responses.
Written by Cristiano Diniz da Silva
Related protips
1 Response
This would look sick with some markdown.
php
$ssl = $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https';
Have a fresh tip? Share with Coderwall community!
PHP applications still send a browser full of JavaScript. Hardening the server does not inventory the payment, analytics, and plugin scripts that run after the HTML is delivered.
Security insights from Cside