# Allow both http and https images over Tor?

**URL:** https://meta.discourse.org/t/allow-both-http-and-https-images-over-tor/128693
**Category:** Support
**Created:** [September 16, 2019, 2:34pm UTC](https://meta.discourse.org/t/allow-both-http-and-https-images-over-tor/128693 "2019-09-16T14:34:02Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Garrick](https://avatars.discourse-cdn.com/v4/letter/g/b9bd4f/32.png) [@Garrick](https://meta.discourse.org/u/Garrick)
#### Post date: [September 16, 2019, 2:34pm UTC](https://meta.discourse.org/t/allow-both-http-and-https-images-over-tor/128693/1 "2019-09-16T14:34:02Z")

</div>

I had to remove the force https function on the site to allow for alternate access. As soon as I did that all logos became broken. The logos cant load because they are being uploaded as http not https. Regular images in the posts seem fine. Its just the logos.

---

<div class="post-metadata">

### Author: ![dax](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/dax/32/244677_2.png) [@dax](https://meta.discourse.org/u/dax)
#### Post date: [September 16, 2019, 3:03pm UTC](https://meta.discourse.org/t/allow-both-http-and-https-images-over-tor/128693/2 "2019-09-16T15:03:03Z")

</div>

> [@Garrick](#):
>
> I had to remove the force https function on the site to allow for alternate access

What kind of access did you need to have to disable the Force HTTPS setting from the site?

---

<div class="post-metadata">

### Author: ![Garrick](https://avatars.discourse-cdn.com/v4/letter/g/b9bd4f/32.png) [@Garrick](https://meta.discourse.org/u/Garrick)
#### Post date: [September 16, 2019, 3:04pm UTC](https://meta.discourse.org/t/allow-both-http-and-https-images-over-tor/128693/3 "2019-09-16T15:04:39Z")

</div>

It was blocking my login access from a tor address. Even if the torrc file was changed to port 443.

---

<div class="post-metadata">

### Author: ![hellekin](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/hellekin/32/51636_2.png) [@hellekin](https://meta.discourse.org/u/hellekin)
#### Post date: [September 16, 2019, 3:23pm UTC](https://meta.discourse.org/t/allow-both-http-and-https-images-over-tor/128693/4 "2019-09-16T15:23:02Z")

</div>

Using TLS over Tor is indeed overkill (since Tor Hidden Services are already encrypted) but if your site has a DNS-visible domain, you should be able to add a Subject Alternate Name that matches `.onion` in your SSL certificate – except that [LetsEncrypt does not support it yet](https://community.letsencrypt.org/search?q=onion).

If indeed you have both `HTTPS` and `HTTP+Tor`, it’s a bit of a problem. Maybe instead of `force_https`, Discourse could use the shortcut `//` like for assets, or use `path_only` so that the full URL is determined by the host, and thus always match the calling scheme.

---

<div class="post-metadata">

### Author: ![system](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/system/32/443519_2.png) [@system](https://meta.discourse.org/u/system)
#### Post date: [April 24, 2023, 11:28am UTC](https://meta.discourse.org/t/allow-both-http-and-https-images-over-tor/128693/5 "2023-04-24T11:28:45Z")

</div>



---

<div class="post-metadata">

### Author: ![JammyDodger](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jammydodger/32/254611_2.png) [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [April 24, 2023, 12:13pm UTC](https://meta.discourse.org/t/allow-both-http-and-https-images-over-tor/128693/6 "2023-04-24T12:13:20Z")

</div>