By znerol on
Change record status: 
Published (View all published change records)
Project: 
Drupal core
Introduced in branch: 
8.0.x
Introduced in version: 
8.0.0-BETA4
Issue links: 
https://www.drupal.org/node/2342593
Description: 

Built-in support for mixed mode SSL sessions has been removed from Drupal core. It is possible to implement this feature entirely via a contributed module (using Drupal's pluggable session management components).

As a result:

  1. An entry for $settings['mixed_mode_sessions'] in settings.php no longer has any effect.
  2. The meaning of the #https key of form structure arrays and the https URL option has changed.

    Before, contributed modules could use these on any sensitive forms or URLs to indicate a preference that the user be switched from HTTP to HTTPS when submitting the form or clicking the link from a non-HTTPS page; the preference was only enforced on sites that indicated support for it by enabling mixed mode SSL sessions.

    Now these options are enforced unconditionally - the form or URL will be forced to try an HTTPS connection regardless of whether the server supports it or not. These options are therefore now intended primarily for use in site-specific custom code rather than generic contributed modules.

Impacts: 
Site builders, administrators, editors
Module developers