form_open helper can't generate https: action link? |
CI 3.x. I want to use CI helper form_open() to generate a simple login form because it can do anti-csrf automagically. Looking at the first step:
<?php echo form_open("foo/fum");?> ... But the generated code specifying the action <form action="http://www.example.com/foo/fum" method="post" accept-charset="utf-8"> ... is flagged by SSL checker missingpadlock.com as insecure -- currently the only flaw on my almost-ready-to-deploy site. I think this should be <form action="https://www.example.com/foo/fum" method="post" accept-charset="utf-8"> ... but I cannot see a way tell the helper to prefix 'https:'. Obvious workaround: don't use form_open(), just straight PHP code to generate the form, but this means learning how to explicitly generate the anti-csrf function -- which I don't feel qualified to do -- or not using it. Am I missing something incredibly obvious? It's very possible... Meta-question: The site's security needs are minimal: login and logged-in users can change their own password and view restricted material -- that's all. I'm using a standard auth package which incorporates anti-brute-force. Maybe I don't need anti-csrf. How would I decide? TIA
What is the value you have assigned $config['base_url']? It should include the protocol and should look something like
PHP Code: $config['base_url'] = 'https://example.com/'; //note the trailing slash And yes, you need CSRF protection. It's best to use this too. PHP Code: $config['csrf_regenerate'] = TRUE; |
Welcome Guest, Not a member yet? Register Sign In |