diff -u b/includes/bootstrap.inc b/includes/bootstrap.inc --- b/includes/bootstrap.inc +++ b/includes/bootstrap.inc @@ -724,6 +724,7 @@ // set to 'https'. // Trusting these headers is a potential security risk so we only do so if // $conf['reverse_proxy'] has been set. + $scheme_rewrite = FALSE; if (variable_get('reverse_proxy', 0)) { $reverse_proxy_proto_header = variable_get('reverse_proxy_proto_header', 'HTTP_X_FORWARDED_PROTO'); if (isset($_SERVER[$reverse_proxy_proto_header]) && strtolower($_SERVER[$reverse_proxy_proto_header]) == 'https') { @@ -731,10 +732,14 @@ // To ensure that third-party code continues working. // They should however implement support for X-Forwarded-Proto themselves. $_SERVER['HTTPS'] = 'on'; + $scheme_rewrite = (boolean) variable_get('reverse_proxy_proto_change', FALSE); } } if (isset($base_url)) { + if ($scheme_rewrite) { + $base_url = $is_https ? str_replace('http://', 'https://', $base_url) : str_replace('https://', 'http://', $base_url); + } // Parse fixed base URL from settings.php. $parts = parse_url($base_url); if (!isset($parts['path'])) { diff -u b/sites/default/default.settings.php b/sites/default/default.settings.php --- b/sites/default/default.settings.php +++ b/sites/default/default.settings.php @@ -263,9 +263,6 @@ * * It is not allowed to have a trailing slash; Drupal will add it * for you. - * - * If you are using a reverse proxy as a crypto offloader, you must ensure that - * this variable is commented. */ # $base_url = 'http://www.example.com'; // NO trailing slash! @@ -387,6 +384,10 @@ * $_SERVER['REMOTE_ADDR'] variable directly in settings.php. * Be aware, however, that it is likely that this would allow IP * address spoofing unless more advanced precautions are taken. + * + * Enable this setting to get Drupal to determine the scheme to use for + * generated URLs using the value of the X-Forwarded-Proto header (or + * $conf['reverse_proxy_proto_header'] if set). */ # $conf['reverse_proxy'] = TRUE; @@ -409,6 +410,13 @@ # $conf['reverse_proxy_proto_header'] = 'HTTP_X_FORWARDED_PROTO'; /** + * Set this value if you want Drupal to modify the scheme of the $base_url + * based on the value of the X-Forwarded-Proto header (or + * $conf['reverse_proxy_proto_header'] if set). + */ +# $conf['reverse_proxy_proto_change'] = TRUE; + +/** * Page caching: * * By default, Drupal sends a "Vary: Cookie" HTTP header for anonymous page