php login with SSL

Question

I've read a lot of questions here about how login can be connected to SSL and so on, but still the idea is not that clear. Based on what I read that I need to have an SSL setup and installed on my web server so that I can use the https secure connection on the page where a login is going to be used. Ok, I have done that part,but still wondering what to include in the login code in order to have the entire session must be over https. in some sites they mention that I have to add this code tep_href_link(FILENAME_ACCOUNT, '', 'SSL') so that the php login page or code be secure.

any comments will be appreciated.

Thanks a lot.

Update: I believe that this code is very important to add so that the login page goes on the https. if(!isset($_SERVER['HTTPS'])) { header("location: https://" . $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI']);
}

Answer 1

HTTPS represents using an algorithm to secure transport layer communications that encrypts what the browser and server are sending each other. The encrypted form that is sent over the network is expensive computationally to turn back into it's original content, unless whoever is decrypting the ciphertext has the paired private key (or... a "computationally weak" algorithm was used).

This is point to point (client sends request to server, server accepts, determines response, sends response), so the browser and server first exchange public keys that represent what the data you are sending or receiving is going to be "scrambled" against. A private key is held by the public key issuer that allows that computer to "descramble" and obtain the original content that was sent to the receiver.

So when you create a private/public key pair, the private key is kept (in confidence and secret) on the server, and the related public key is sent to the browser. The browser, likewise, does the same thing and transmits a public key to the server.

"Protecting" sensitive information is not all that's going on; you may also use SSL/TLS to prevent tampering with data, for example, or even as an additional verification step.

To get HTTPS setup and available for you to use, you need to:

1. Procure a public/private key (signing by a certificate authority, or CA, is potentially optional depending on your end users).
2. Install it into the key store on the server that is available to your web server. OpenSSL is used for both of these steps in many cases.
3. Setup your system to use HTTPS URLs (for all resources, not just a <form action="https://...">s).

Couple of notes:

• Browsers have their own certificates, so don't worry about that.
• Many CMS' and frameworks allow you to specify HTTPS at the application layer

You can use WireShark to inspect what your computer is actually sending and receiving. This can be very illuminating, especially in combination with viewing the request/response in Firebug or Chrome Net consoles.

PHP online manual has the OpenSSL "book". Here is an example of how CodeIgniter handles configuring HTTPS at the application level.

There's various tutorials on how to setup SSL on a LAMP stack. Here is a tutorial on WAMP2 HTTPS and SSL Setup if you just need a development environment.

If you have a shared hosting environment, you may not be able to do the SSL setup on the server yourself; that may be handled by the server administrator. Check with your host. DreamHost, for example, has extensive docs.

Answer 2

Um, on a quick google, this function (tep_href_link) appears to be part of osCommerce. If your site has an SSL certificate setup properly, forcing users to an https url should be fine. If you don't know how to do that look into Location headers or mod_rewrite.

Also, as an aside, one thing you will need to do, is to ensure all links on the page are going over https. That will increase the likelihood of getting the green lock or w/e when a user comes to the page, assuming the cert isn't self-signed.