# Session\_controller: Force SSL setting messes up SSO process
**URL:** https://meta.discourse.org/t/session-controller-force-ssl-setting-messes-up-sso-process/113394
**Category:** Bug
**Created:** [April 3, 2019, 10:51pm UTC](https://meta.discourse.org/t/session-controller-force-ssl-setting-messes-up-sso-process/113394 "2019-04-03T22:51:11Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@technik](https://meta.discourse.org/u/technik)
#### Post date: [April 3, 2019, 10:51pm UTC](https://meta.discourse.org/t/session-controller-force-ssl-setting-messes-up-sso-process/113394/1 "2019-04-03T22:51:11Z")
Hi,
i have a fully working discourse instance with SSO support.
Everything is https.
Recently I activated the force\_https option in the settings, because some browser promted the user, that parts of the website aren’t secure.
Enabling this settings fixed this error, but resulted in a new one:
The SSO process is broken, if I activate the force\_https setting.
How can this be the case?
My php scripts redirects the user as usual:
`https://domain.com/session/sso_login?sso=". $payload ."&sig=". $return_sig`
But discourse opens up and doesn’t login the user, nor shows any kind of erros.
The logging shows only one single difference at the backtraces for the following line:
NOT WORKING:
`/var/www/discourse/app/controllers/session_controller.rb:38:in `sso’`
WORKING:
`/var/www/discourse/app/controllers/session_controller.rb:165:in `sso\_login’`
Why does the session\_controller messes up the sso process?
Thanks a lot for your support 🙂
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [April 3, 2019, 10:54pm UTC](https://meta.discourse.org/t/session-controller-force-ssl-setting-messes-up-sso-process/113394/2 "2019-04-03T22:54:51Z")
Did you update your SSO to connect to the HTTPS address for Discourse?
---
### Author:  [@technik](https://meta.discourse.org/u/technik)
#### Post date: [April 3, 2019, 11:09pm UTC](https://meta.discourse.org/t/session-controller-force-ssl-setting-messes-up-sso-process/113394/3 "2019-04-03T23:09:32Z")
Thank you for your instant reply 😃
Yes of course I updated it, it is set on https since the beginning.
The exact php redirect code is:
`header("Location: https://domain.com/session/sso_login?sso=". $payload ."&sig=". $return_sig);`
I don’t understand it.
Without force\_https the process is working, but with it is not ☹
The paylog and sig must be correct, because it works perfectly without this option enabled.
Everything is all https: Discourse (of course), the external login page (receives sso data correctly) and the redirect url after the login from the external page.
But discourse ignores it..
Does anyone why this behaves in such a buggy way? 🙂
---
### Author:  [@technik](https://meta.discourse.org/u/technik)
#### Post date: [April 7, 2019, 7:48pm UTC](https://meta.discourse.org/t/session-controller-force-ssl-setting-messes-up-sso-process/113394/4 "2019-04-07T19:48:04Z")
Has anyone an idea on how the force\_https option influences the SSO process?
Why can it be the case that a functional `https://domain.com/session/sso_login?..` request, that works perfectly without this options enabled, get surprisingly rejected if the options gets enabled?
Thanks a lot for your support 🙂
---
### Author:  [@vinothkannans](https://meta.discourse.org/u/vinothkannans)
#### Post date: [April 8, 2019, 5:14am UTC](https://meta.discourse.org/t/session-controller-force-ssl-setting-messes-up-sso-process/113394/5 "2019-04-08T05:14:06Z")
You should watch your network traffic to find the difference.
---
### Author:  [@kicolobo](https://meta.discourse.org/u/kicolobo)
#### Post date: [September 10, 2019, 11:24pm UTC](https://meta.discourse.org/t/session-controller-force-ssl-setting-messes-up-sso-process/113394/6 "2019-09-10T23:24:23Z")
I’m facing this exact same problem using the latest version of Discourse: v2.4.0.beta4
Does anyone here have any clues about how to solve this?
---
### Author:  [@trying2survive](https://meta.discourse.org/u/trying2survive)
#### Post date: [December 15, 2020, 10:20am UTC](https://meta.discourse.org/t/session-controller-force-ssl-setting-messes-up-sso-process/113394/7 "2020-12-15T10:20:43Z")
Were you able to resolve this issue? If yes, can you please share the steps you have taken? Thanks!