Newer browsers block mixed content on HTTPS pages. The Drupal install system generates HTTP URLs when the site is accessed through a reverse proxy, even when the reverse proxy uses HTTPS and reverse proxy settings have been configured in settings.php. The installation fails to complete because it depends on JavaScript for batch processing.

Comments

Darren Oh created an issue. See original summary.

darren oh’s picture

StatusFileSize
new1.02 KB
darren oh’s picture

darren oh’s picture

darren oh’s picture

darren oh’s picture

Assigned: darren oh » Unassigned
Status: Active » Needs review
alexpott’s picture

Issue tags: +Needs manual testing
StatusFileSize
new4.18 KB
new3.69 KB

I also think we need to do a little bit more to have everything covered.

Something like the patch attached.

alexpott’s picture

Priority: Critical » Major
Issue tags: +rc target

Discussed with @catch - we feel that this is only a major (that we'd like to fix before release) because it requires that you are using a reverse proxy, https and the web installer. Probably not a common situation.

alexpott’s picture

The real issue here is that the installer is not handling the request through the kernel and requires refactoring to do that. It would be a massive amount of work and not something we're going to attempt before D8 release.

cilefen’s picture

As a workaround, this may help. You can set environment variables in Apache, for example, by having the proxy send X-Forwarded-Proto = https:

# This helps applications behind a proxy know that the pages
# were originally requested over https

SetEnvIf X-Forwarded-Proto https HTTPS=on
darren oh’s picture

Status: Needs review » Reviewed & tested by the community

The patch attached to #7 works. Just to be clear, there is no need to wait for the massive amount of work required to get the installer to handle requests through the kernel. Both of the patches attached to this issue fix the way the installer handles requests now.

catch’s picture

Status: Reviewed & tested by the community » Fixed

Committed/pushed to 8.0.x, thanks!

  • catch committed 9fb76ea on 8.0.x
    Issue #2609076 by alexpott, Darren Oh: Install failure with HTTPS...

  • catch committed 9fb76ea on 8.1.x
    Issue #2609076 by alexpott, Darren Oh: Install failure with HTTPS...
isntall’s picture

This one bit me with nginx and php-fpm.
After trying to install head I still was getting mixed content warnings from Firefox, and thus no theme.
This fixed it for me on nginx

fastcgi_param HTTPS $https;

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.