The discussion revolves around changing the base_url in Discourse email templates to use “https://”. akvadrako wants to modify the base URL to ensure links shared externally are secure, preventing potential MitM attacks. itsbhanusharma suggests enabling the force_https setting, which omarfilip is already using, but still experiencing issues with email links. Falco explains that force_https is hidden and enabled by default, and can be verified in the rails console. Despite this, omarfilip finds that the setting is enabled, yet email links are still not using “https://”.
The links discourse is sending in emails use the http:// scheme, not https. Is there a way I can modify the base_url for email templates?
I like to setup my webserver so all plaintext http requests are redirected to my https homepage. This ensures links shared externally with an incorrect scheme will not work, so an accidental future misconfiguration will not expose any users to MitM attacks. So the email links will be broken, as a redirect will not work.
I Guess you need to enable the force_https settings in discourse
My Discourse is also sending emails with http://email.forum.mydomain.com/ links instead of https://email.forum.mydomain.com/
I’m pretty sure I had force_https set to true before, and I went to check, but that setting is now missing from the admin. Where did it go?
It is hidden and enabled by default on new installs. You can drop into the rails console and check for it there:
./launcher enter app
rails c
SiteSetting.force_https
SiteSetting.force_https = true
exit
exit
exit
Indeed it is set to true. So the question is why are the email links not https?