如何在PHP中使网站在HTTP和HTTPS中都能工作？

Question

I have a website that was written assuming http:// is one and only protocol forever. Now i bought a SSL certificate but when i visit site calling it with https:// i get info in browsers that part of site is insecure. As i found i have some JS, CSS and images and files that i refer to using http:// in the HTML of the site.

So what is best practice to enable full https? Should i change my website in every place when i refer to image, CSS or JS, check if site was loaded with http or https and load the resource with according protocol? It seems like a lot of work for me and bit error prone. Is there any other way, easier to make the whole site fully secure?

Answer 1

与其使用http://yoursite.com/css/file.css链接到CSS，js和图像，不如使用/images/image.jpg和/css/file.css之类的相对路径，这样它将与包括http和https，而且如果您更改域或将内容复制到另一个域，也不必更改所有这些链接。

Answer 2

Use relative paths. If you are pointing to something that is on the same site as yours, then you should not be using http://

If for some reason you still need to have http:// then just switch them all to https://. An http:// will never complain because it is pointing to https:// stuff, but an https:// page will complain if it is pointing to non-https stuff.

If you are pointing to content outside of your control, on another site for example, then you need to hope that you can get at that content via https instead. If you can't, then you're hosed and you either need to live with the error, get the content from somewhere else, or proxy the content through your own https connection.

Answer 3

To complement @drew010 's answer, you could use other domains and still refer to the current protocol with // , something like:

<img src="/pics/home.png" />
<img src="//my-cdn.com/pics/info.png" />

The latter example will point to https://.. from https://your-site.com and http://... from http://your-site.com .

Answer 4

the best practice would be either using relative path rather than absolute but sometimes absolute is a better option so you can do the following :

as I can imagine you have a file called config.php or common.php (a file that stores your common used vars and you include it in every page), so put this code there :

function selfURL() {
$s = empty($_SERVER["HTTPS"]) ? '' 
    : ($_SERVER["HTTPS"] == "on") ? "s" : "";
$protocol = strleft(strtolower($_SERVER["SERVER_PROTOCOL"]), "/").$s;
$port = ($_SERVER["SERVER_PORT"] == "80") ? "" : (":".$_SERVER["SERVER_PORT"]);
return $protocol."://".$_SERVER['SERVER_NAME'].$port.$_SERVER['REQUEST_URI'];
}

function strleft($s1, $s2) {
return substr($s1, 0, strpos($s1, $s2));
}

and then you can assign a var called $http to get the value of the function like : $http = selfURL(); and then whenever you want to include anything like images, css, etc do something like :
<img src="<?=$http?>images/sample.png" />

this method is reliable as it works in any situation.