Login dialog missing link to logo because DISCOURSE_FORCE_HTTPS set to ‘false’

Product Support

AI-generated summary

Paul_King reported a missing logo placeholder on the login dialog of their Discourse forum, while the logo appeared correctly after logging in. NateDhaliwal suggested checking if anonymous file download restrictions or safe mode were causing the issue. JammyDodger clarified that the issue seemed isolated to the ‘login required’ landing page. Upon investigation, Paul_King identified multiple ‘Mixed Content’ errors in the browser console, where the HTTPS page attempted to load insecure HTTP resources like fonts, favicons, and images. JammyDodger noted the relevance of these warnings to recent site changes. Paul_King confirmed the root cause was the DISCOURSE_FORCE_HTTPS setting in their app.yml being set to false. After changing this setting to true and rebuilding the application, the logo reappeared, and the administrator dashboard warnings were resolved.

1

I have just discovered that my forum login dialog now shows a ‘missing’ placholder symbol, where the forum logo used to appear.

Once logged in, the site primary logo appears normally

I only have two logo variants uploaded - the standard ‘Primary logo’, and ‘Small logo’ - with the others variant options not used, thus defaulting to one of the first two.

I am not certian, but wonder if this is associated with a recent forum update or rebuild?

Could something be preventing access to site resources like logos for non-logged in users?

2

I wonder… could it be caused by this?

(post)

Does this happen in safe mode? Are there any errors in the browser console?

3

In case it helps narrow it down, I think this is on the ‘login required’ landing page? (Correct me if I’m wrong :slight_smile:) I can see the logo header as usual on both your signup and login page proper.

4

Thanks @NateDhaliwal, some good sugguestions.

Toggling that setting then reloading makes no difference.

I can’t seem to access safemode at all - https://discourse.nzarchiture.net.nz gives a dead link warning in my browser (as does http://discourse.nzarchiture.net.nz)

There certianly are errors on that page - suggusting the login dialog is for some reason trying to reference a mixture of https and http based urls for its content.

(index):365  Mixed Content: The page at 'https://nzarchitecture.net.nz/' was loaded over HTTPS, but requested an insecure font 'http://nzarchitecture.net.nz/fonts/JetBrainsMono-Regular.woff2?v=0.0.19'. This request has been blocked; the content must be served over HTTPS.
(index):365  Mixed Content: The page at 'https://nzarchitecture.net.nz/' was loaded over HTTPS, but requested an insecure font 'http://nzarchitecture.net.nz/fonts/JetBrainsMono-Bold.woff2?v=0.0.19'. This request has been blocked; the content must be served over HTTPS.
app.js:297 ℹ️ Discourse v2025.12.0-latest — https://github.com/discourse/discourse/commits/4e84c286d6 — Ember v6.6.0
content.js:18 [Form Persistence] 初始化表单持久化扩展...
content.js:868 shouldRun: false
(index):1  Mixed Content: The page at 'https://nzarchitecture.net.nz/' was loaded over HTTPS, but requested an insecure favicon 'http://nzarchitecture.net.nz/uploads/default/optimized/1X/f194d3ff8870aa98f79a9aef41a5d954c243aef6_2_32x32.png'. This request has been blocked; the content must be served over HTTPS.
content.js:13 [Form Persistence] 从存储中获取的数据: Object
content.js:18 [Form Persistence] 当前页面未启用表单持久化
(index):1  Mixed Content: The page at 'https://nzarchitecture.net.nz/' was loaded over HTTPS, but requested an insecure element 'http://nzarchitecture.net.nz/uploads/default/original/1X/5d5ed6d82ef2bd08985655747ca1f2d08e94ac0e.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
(index):1  Mixed Content: The page at 'https://nzarchitecture.net.nz/' was loaded over HTTPS, but requested an insecure image 'http://nzarchitecture.net.nz/uploads/default/original/1X/5d5ed6d82ef2bd08985655747ca1f2d08e94ac0e.png'. This request has been blocked; the content must be served over HTTPS.
(index):1  Mixed Content: The page at 'https://nzarchitecture.net.nz/' was loaded over HTTPS, but requested an insecure element 'http://nzarchitecture.net.nz/uploads/default/optimized/1X/f194d3ff8870aa98f79a9aef41a5d954c243aef6_2_512x512.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
content.js:18 [Form Persistence] 收到状态检查指令
content.js:13 [Form Persistence] 从存储中获取的数据: Object
content.js:18 [Form Persistence] 页面状态更新: Object

I also don’t know where those chinese characters amongst the console warnings come from, and whether they are a cause for concern? The site itself was created in English, and has no other translations set up.

How do I tell Discourse to only load images over https?

5

The mixed content warnings may be important, especially in conjunction with your other topic Bogus Dashboard advice

@Paul_King Could it have happened as part of these recent changes to your site? Bootstrap error during Discourse install: ENOENT - /etc/runit/1.d/letsencrypt - #9 by pfaffman

6

Yes, you are quite right, thanks @JammyDodger

Turns out my app.yml had the DISCOURSE_FORCE_HTTPS setting set to ‘false’

After changing it to ‘true’ & rebuilding, the logo reappears, and the warning in the administrator dashboard dissapeared.