# Problems with Force https and mixed https content

**URL:** https://meta.discourse.org/t/problems-with-force-https-and-mixed-https-content/118337
**Category:** Self-hosting
**Created:** [May 21, 2019, 8:29pm UTC](https://meta.discourse.org/t/problems-with-force-https-and-mixed-https-content/118337 "2019-05-21T20:29:14Z")
**Posts on this page:** 1
**Showing post:** 15

<div class="post-metadata">

### Author: ![alphanoob1337](https://avatars.discourse-cdn.com/v4/letter/a/e495f1/32.png) [@alphanoob1337](https://meta.discourse.org/u/alphanoob1337)
#### Post date: [September 27, 2020, 7:04pm UTC](https://meta.discourse.org/t/problems-with-force-https-and-mixed-https-content/118337/15 "2020-09-27T19:04:46Z")

</div>

I have the exact same issue as the people reporting here and in this [thread](https://meta.discourse.org/t/session-controller-force-ssl-setting-messes-up-sso-process/113394).

The issue is not to related to the SSO implementation nor the webserver: In my case http requests are redirected to https, which is then sent through the reverse proxy. SSO works perfectly if I redirect the user to http **s** ://discourse.fqdn.top/session/sso\_login?sso=PAYLOAD&sig=SIGNATURE and `force_https` is **false**. Showing that both the SSO part and proxy work perfectly well. Only when I switch `force_https` to **true** , it stops working. When I have a pre-existing session, I can change `force_https` to true and use discourse without any issues (further cementing the point, the issue is not related to the reverse proxy). Leaving `force_https` false is not an option because it breaks logos and Chrome is not happy, when assets from http and https are mixed (it shows a small alert in the address bar, that the page is not secure).

---

_[View the full topic](https://meta.discourse.org/t/problems-with-force-https-and-mixed-https-content/118337)._