Hello, I tried using Force https and it seemed to work for me except it was causing login problems. However, the logos are loaded using http by default. They should use the // protocol and let the browser decide which one to use, right? Or maybe there is another solution I’m missing? Thanks

Hi Eddie, What version of Discourse are you running? In recent versions logos are uploaded via site settings, instead of being linked using a URL, so this should no longer be an issue.

Hi Joshua, We recently upgraded to v2.2.5. During the previous upgrade, before force https, I believe I deleted the post where the logos were uploaded and switched to the site settings. Everything was fine. Then with v2.2.5, I can’t get rid of the http:// part without force https. I tried reuploading, the wizard, even modifying the images so their hash was different. No luck

[image] EddieOne: Then with v2.2.5, I can’t get rid of the http:// part without force https Sorry, now I’m confused. Is force_https enabled or not? Is there any possibility you’re overriding the uploaded logos via themes? If your force_https is enabled, and your logos are served via site settings, there should not be a mixed content warning. Are you able to share a link to your site so I can take a look?

It was enabled, thought the upgrade was over. Then our QA reports that logins are not working. so we disabled force https for now. You can test here //forum.y8.com I checked the themes and didn’t spot anything that might cause this https problem. We mostly use stock, though it is an old stock theme.

With force_https disabled, I can’t test this. We rely on that setting to ensure assets are served over https, not http. Regarding the login issue, it appears you’re using SSO, so ensure the SSO redirect from your provider links to your site via https://, not http://. Once you’ve re-enabled force_https I can take another look.

This forum is using the oauth2 basic plugin. Maybe there is a problem with that, might require a version roll back. Not sure yet. I did check the settings, all addresses were using https, so no obvious problem there.

I have a similar problem here: After finding that the logo and the large icon are loaded via http causing mixed content, enabling force_https fixed this. But login wasn’t possible anymore leading to a redirect loop. After disabling this option, login works again. Why is this happening? And why are only those two images loaded via http, while all other assets are loaded correctly loaded via https?

What is your login method? I’m guessing it’s not local (username/password) login?

Is there any proxy or other service in front of your installation?

I’m using SSO via another web application. nginx is used as a reverse proxy.

Problems with Force https and mixed https content

Product Support Self-hosting

michaeld (Michael - Communiteq) September 27, 2020, 8:02pm 16

What does your nginx config look like and do you have an X-Forwarded-Proto header in it?

Topic		Replies	Views
Moved site behind proxy, favicon and header not using https anymore Product Support	11	2531	May 26, 2020
Changing force_https does not update the url of uploaded images causing a mixed content warning Bug	7	1669	December 14, 2020
Login dialog missing link to logo because DISCOURSE_FORCE_HTTPS set to ‘false’ Product Support	5	321	December 9, 2025
Discourse not aware of SSL termination (mixed content) Self-hosting	7	2072	August 8, 2019
Mixed SSL since upgrade Self-hosting	13	960	December 30, 2022

Problems with Force https and mixed https content

Related topics