Is basically broken.
There I said it. I have a site which is hidden behind a proxy server. The WP machine is running a vanilla PHP install on Apache with no SSL cert. The reason is that the blog is but one server in a cluster of many different machines with different jobs all living under a common domain (call it http://www.example.com). There is a NGINX server in front of everything handling routing based on url paths. The NGINX handles the SSL encryption and then communicates with backend servers using http. Works fine.
However – this means that the WP installation thinks it is operating under http rather than https. Any test of headers in any code comes up with protocol http and not https. So any absolute URLs generate such as for style sheets and JS files are being generated with a big fat http: in front and conservative browsers like Chrome are declining to load them as they are viewed as potential security threats. The problem actually runs to the very core of WP but Genesis does its part to encourage the madness. There is a solution though.
In order to fix our site I did the following modifications to the definition of CHILD_URL and PARENT_URL. I did
define( ‘CHILD_URL’, ltrim(get_stylesheet_directory_uri(),’htpsHTPS:’) );
which crudely strips off any leading http/https protocol. The reason this is OK is because RFC 3986 part 4.2 allows for protocol-less or protocol relative URLs. So instead of http://www.example.com it is fine to use //www.example.com and the browser will use whatever protocol was used to fetch the parent page.
Please update your code to use protocol-relative URLs and join me in influencing WP developers to switch to protocol-relative URL generation. In the end, all our code will be more secure.
You must be logged in to reply to this topic.
Are you a blogger, web designer, developer, or website owner looking to generate more income?
Promote products for the largest and fastest growing online website platform as part of our affiliate program.