PHP - Https Security

It seems to me that this should be easy, but I can't find it in the manual or the on the web, and the values in $_SERVER don't suggest anything.

Context: script A loads script B using HTTPS. Now script B has to load resources (images, style sheets, etc). Browsers often object to HTTP references from a script run by an HTTPS request, so script B should generate URLs that use HTTPS. Thus it has to know that it was loaded with HTTPS.

I can do this by brute force if I have to (defining a "protocol" constant in the script itself), but I'd rather make the test automatic.

I am using file_get_contents with a url (http) to screen scrape certain web pages that are publicly accessible.
However there are certain web pages (https) that require me to use an x509 certificate stored in my browser to make them visible.
I would like to scrape them too.

How would I scrape them using a php script?

Thanks in Advance.

Should I always use HTTPS when users are inputting credit card numbers & billing info? Do you know any sites that don't use HTTPS? I just want to know if it's a total no-no for web applications.

Discuss.

(Trying to get my brain back into this old problem which I fixed but want to re-code a better way...)

So I was having problems with getting some browser error when people would go to checkout because the page logo was coming from an HTTP source and the page was an HTTPS page.

I created a "config" file and had this code...
Code: [Select]
<?php
define('ENVIRONMENT', 'development');
//define('ENVIRONMENT', 'production');

// Secure Web Server Root
define('SECURE_WEB_ROOT', ENVIRONMENT === 'development'
? 'http://local.dev3/'
: 'https://www.mysite.com/');
?>

Then in my page I had...
Code: [Select]
<div id="header">
<a href="<?php echo WEB_ROOT ?>index.php">
<img id="logo" src="<?php echo SECURE_WEB_ROOT ?>images/mylogo_200x50.png"
width="200" alt="My Logo" />
</a>
</div>


Is there a better way to do this and eliminate my Config file which is no longer needed since I learned how to create a "Virtual Server"?


Debbie

I am relatively new to php and am working on a small project for myself where I need to make a secure https connection to my supplier's web server and have to pass a data string to the server using the POST method.

I've googled 'using php to make https connections', but am having difficulty getting started in learning about this process.  The PHP manual is somewhat too 'techie' for my level.

Does anyone have a suggestion where I can get started?

Thanks.

Hi guys.. i am not very sure where to post about this issue but im giving a try and hope to get some ideeas where this might come maybe.

So i have a small website with a members database.. the website itself it has SSL and works properly on a https connection. The problem comes when a member tries to access via http. Unfortunetaly on a page i have to keep it http due to some ads that i display there and dont work on https.

If a member logs in and surfs the website via https everything is working perfectly.. but when he changes and tries to access via http he automatically gets logged out.. if he tries to login via http he also cant and gets an error with an invalid token.

So basically i think my database cant connect when accessed by http..

Any of you ever encountered this issue ? Or maybe have some ideeas where this issue is coming from ?

 

Thanks and any ideea or help very appreciated

This is a two part question... my previous post was surrounding an issue with Sessions, now I was told that it may be a server side issue so I contacted my host provider who said to me that sessions cookies REQUIRE https?? now this can't be valid because I've had no issues with sessions prior to this week - second part of this is, is there something I'm missing with maybe an updated versions? 

 

PS: yes, i'm new and simply trying to learn...

Hi Everyone,   I am really struggling with this.....Cannot find a solution anywhere.   I have a website with SSL installed. I would like to force SSL on the whole website but not on 2 urls.   If my whole site is https://mysite.com   and the 2 urls to disable from the SSL a http://mysite.com/hotels http://mysite.com/weather   How can I do it via htaccess please?   Thank you so much,   Ben

Hi all "im new here"
 
Hoping someone can help me with this peculiar problem.
 
I have a vps running Plesk (9.5.4) + PHP 5.3
 
For the domain I am working on, I have specified additional directories to the PHP include_path via vhost conf file.
 
One of those directories is outside of webroot, so is same level as httpdocs.
  eg:

:/var/www/vhosts/example.com/outer_includes

My scripts are able to include PHP files, using require, include etc from the directory added to PHP's include, so I know that its working perfectly.
 
Problem I have is that if I call a script with HTTPS, I get require_once fatals, as for some reason the includes no longer work.     --------------------------------------------------- eg:   include_me.php lives in a directory on same level as httpdocs, which has been added to PHP include directories.

/var/www/vhosts/example.com/outer_includes/include_me.php

script.php contains:

<?php

require_once('include_me.php');

?>

Calling:   http://www.example.com/script.php   This works as expected.   Calling:   https://www.example.com/script.php   This fails with fatal on the require_once() ---------------------------------------------------
 
I am self taught and fully expect this to be another hole in my knowledge but I can't seem to fill this one by asking Google.
 
Can anyone advise? Would be very grateful
 
Boreas
Edited by Boreas, 02 September 2014 - 04:20 PM.

Apache https setup!   Okay so i made my own SSL certificate for my localhost using these commands   OpenSSL: ( CMD > c:\xampp\apache\bin\openssl )

req -config c:\xampp\php\extras\ssl\openssl.cnf -new -out jobnow.csr -keyout jobnow.pem
rsa -in jobnow.pem -out c:\jobnow.key
x509 -in jobnow.csr -out jobnow.crt -req -signkey c:\jobnow.key -days 369

when asked for common name type your ip address.    Then i install import the certificate to certmgr.msc   Restate Apache   https//192.168.0.14   - Doesnt work 192.168.0.14 - Works fine   Apache error log:

[Wed Sep 10 12:05:41.299000 2014] [ssl:warn] [pid 7840:tid 260] AH01909: RSA certificate configured for localhost:80 does NOT include an ID which matches the server name
[Wed Sep 10 12:05:41.301000 2014] [ssl:warn] [pid 7840:tid 260] AH01909: RSA certificate configured for 192.168.0.14:443 does NOT include an ID which matches the server name
[Wed Sep 10 12:05:41.301000 2014] [ssl:warn] [pid 7840:tid 260] AH01915: Init: (localhost:80) You configured HTTPS(443) on the standard HTTP(80) port!
[Wed Sep 10 12:05:41.373000 2014] [co warn] [pid 7840:tid 260] AH00098: pid file C:/xampp/apache/logs/httpd.pid overwritten -- Unclean shutdown of previous Apache run?
[Wed Sep 10 12:05:41.616000 2014] [ssl:warn] [pid 7840:tid 260] AH01909: RSA certificate configured for localhost:80 does NOT include an ID which matches the server name
[Wed Sep 10 12:05:41.617000 2014] [ssl:warn] [pid 7840:tid 260] AH01909: RSA certificate configured for 192.168.0.14:443 does NOT include an ID which matches the server name
[Wed Sep 10 12:05:41.617000 2014] [ssl:warn] [pid 7840:tid 260] AH01915: Init: (localhost:80) You configured HTTPS(443) on the standard HTTP(80) port!
[Wed Sep 10 12:05:41.659000 2014] [mpm_winnt:notice] [pid 7840:tid 260] AH00455: Apache/2.4.7 (Win32) OpenSSL/1.0.1e PHP/5.5.9 configured -- resuming normal operations
[Wed Sep 10 12:05:41.659000 2014] [mpm_winnt:notice] [pid 7840:tid 260] AH00456: Apache Lounge VC11 Server built: Nov 21 2013 20:13:01
[Wed Sep 10 12:05:41.659000 2014] [co notice] [pid 7840:tid 260] AH00094: Command line: 'c:\\xampp\\apache\\bin\\httpd.exe -d C:/xampp/apache'
[Wed Sep 10 12:05:41.661000 2014] [mpm_winnt:notice] [pid 7840:tid 260] AH00418: Parent: Created child process 7032
[Wed Sep 10 12:05:42.319000 2014] [ssl:warn] [pid 7032:tid 272] AH01909: RSA certificate configured for localhost:80 does NOT include an ID which matches the server name
[Wed Sep 10 12:05:42.321000 2014] [ssl:warn] [pid 7032:tid 272] AH01909: RSA certificate configured for 192.168.0.14:443 does NOT include an ID which matches the server name
[Wed Sep 10 12:05:42.321000 2014] [ssl:warn] [pid 7032:tid 272] AH01915: Init: (localhost:80) You configured HTTPS(443) on the standard HTTP(80) port!
[Wed Sep 10 12:05:42.645000 2014] [ssl:warn] [pid 7032:tid 272] AH01909: RSA certificate configured for localhost:80 does NOT include an ID which matches the server name
[Wed Sep 10 12:05:42.646000 2014] [ssl:warn] [pid 7032:tid 272] AH01909: RSA certificate configured for 192.168.0.14:443 does NOT include an ID which matches the server name
[Wed Sep 10 12:05:42.646000 2014] [ssl:warn] [pid 7032:tid 272] AH01915: Init: (localhost:80) You configured HTTPS(443) on the standard HTTP(80) port!
[Wed Sep 10 12:05:42.688000 2014] [mpm_winnt:notice] [pid 7032:tid 272] AH00354: Child: Starting 150 worker threads.
[Wed Sep 10 12:05:54.589000 2014] [authz_co error] [pid 7032:tid 1652] [client 192.168.0.14:3112] AH01630: client denied by server configuration: C:/xampp/htdocs/
[Wed Sep 10 12:05:54.682000 2014] [authz_co error] [pid 7032:tid 1652] [client 192.168.0.14:3112] AH01630: client denied by server configuration: C:/xampp/htdocs/favicon.ico

It says my server name does not match, So i changed the server name to: ( httpd-ssl.conf ) around line 80 ServerName 192.168.0.14:443 DocumentRoot to my httpd.conf document root     My .key is in apache/conf/ssl.key my crt is in apache/conf/ssl.crt       I hope this helps someone else! i had to post this after how much trouble it was causing me!

Not sure if my title line was worded correctly, but here is what I am trying to understand...

I need to hook my website up to a payment gateway to accept credit cards.

After I package up the customer's payment details and send the payment gateway an XML string, their server supposedly sends back a request for more information OR it indicates a Pass/Fail message.

This is where I am getting lost.

If I send data over HTTPS using POST, then how am I supposed to receive a message back from them?

It's not like we are on the telephone and there is a "live" link between my web server and theirs?!

Can someone please explain how this works?

Thanks,



Debbie

Hi im a newbie php developer and am experiencing two problems at the moment. The first and most important is that google charts can not save over https i have copied a function that should save the file but i am clueless as to how it work s and where i am going wrong with it ??? any help with this would be greatly appreciated. Secondly every time i hit submit the page first posts data and then i have to submit again before it posts the data to google charts api ?

Again any help would be greatly appreciated Thanks in advance ill add all the code here for you guys.

Saving the google chart api

function saveImage($chart_url,$path,$file_name)
{
   if ( (!file_exists($path.$filename)) || (md5_file($path.$filename) != md5_file($chart_url)) )
   {
      file_put_contents($path.$filename,file_get_contents($chat_url));

   }
   return($filename);
}

function doSomething()
{
   $local_image_path ="home/sean/img/charts/";
   $imagename="some_chart_image.png";
   $chart_url = $chartimage;
   $image = saveImage($chart_url ,$local_image_path,$image_name);
   echo "Image Saved";
}

$body .=   "<table class='formTABLE'>
      <tr>
      
      <TD class='FieldCaptionTD' align='right' colspan='2'>
         <input class='Button'  method='post' action='' align='right' type='submit' name='save_file' value='Save'>
         <input class='Button'  method='post' action='' align='right' type='submit' name='submit_button' value='Submit'>
         </center>            
      </TD>
   </tr>
   </table>";
$body .= htmlmaintsplit();
?>
<img src="/home/sean/work/some_chart_image.png" alt="" />

How am i to use this now to save the graph i have created ???

Relating to the submit button problem - this is set after the submit button though i have tried placing the submit button beneath this code but still the same problem persists

<form action='<?php echo $action?>' method='POST' name='bargraph' value='bargraph' chid='post_form'
onsubmit="this.action = 'http://chart.apis.google.com/chart?chid=' + (new Date()).getMilliseconds(); return true;">

Okay, my organanization has a page that we really need to autodirect to https:// in case anyone manually types in the http:// version.

I've tried this (among many others) and it just sits there like a knot on a log:

Code: [Select]
<?php
header( "Location: https://www.mywebsite.com/myfile.php" ) ;
?>
Any ideas? It just simply doesn't redirect. It just sits there in its http:// format. I've also tried numerous other methods. None of them worked, either, but this is the simplest.

Thanks!

Hi guys,

We have an independent billing system that we use to track payments. I want to write a PHP script to automatically post a payment to the billing system.

I went into the billing system, hit "View source" and got the link + required variables that will allow me to simulate entering a payment.

The problem is that it's asking me to enter my credentials everytime I try to simulate the payment. Is a module or something that will automatically enter my credentials in this HTTPS site?

Thanks

Hello,

i want to send and receive data from https url.

how it can be done in php?

Thanks