Releases for Secure Login

• #3248820: Force password reset login requests to login via HTTPS
• Documentation improvements

1. The Secure Login settings page now recommends that the registration form be secured - regardless of the e-mail verification setting - to ensure that secure links are generated in email messages.
2. Fix typo in config schema
3. Fix test failures

Due to changes in Drupal 7.79, move user_pass and user_register_form to the "required" section of forms to be secured.

Please visit the admin/config/people/securelogin page and ensure that the checkboxes for securing the user password request and user registration forms are checked!

• Code style fixes.
• Static analysis fixes.
• Resolve deprecations.
• When changing configuration on the settings page, delay the cache flush until shutdown.

Minor update:

• Avoid use of deprecated method for Drupal 8.5 compatibility.
• Documentation improvements.

Another minor release for Drupal 8.4.x compatibility.

• This update prevents a fatal error on sites running Drupal 8.4.x with page cache enabled.

Fixes #2778585: Allow specifying different port for HTTPS: Ensure that the secure base URL setting, if set, is used for redirects to HTTPS site.

This release works around mixed-content warnings on the HTTPS site due to the HTTP base URL being used by core in render caches as well as aggregated CSS files: #2622382: Work around core bugs re: base URLs in render caches and aggregated CSS

See also these core issues for other potential solutions, like setting the url.site cache context whenever the base URL is used:

Initial release of Secure Login module for Drupal 8.

This release of Secure Login module provides some new features and bug fixes:

New features:

The password reset form should be secured, because submitting this form creates an authenticated session. Also add options to secure the password request and contact forms.

Initial release for Drupal 7.

Initial 6.x release.