Question: http vs https

[MadMango]

I know https is a secure site. My question is how can you have different sites with basically the same URL?

Example...

https://www.phenomquest.net/

and

http://www.phenomquest.net/

Any takers on this one?

 

[Genimuse]

You can't really have different sites like that, but you can have code in the page that detects whether or not SSL is active and have it redirect the user based on the results. In that sense you have different sites.

 

[MadMango]

On the https version of this URL, I don't see any code that would redirect a user when I "View Source".

 

[palbano]

>> I don't see any code that would ...

hopefully not. that should be server side code.

-pete

 

[Genimuse]

As an example, using Active Server Pages (ASP) you would check the value of

Request.ServerVariables("HTTPS")

-- if it's "ON" then the page was accessed through a secure channel, and if it's "OFF" then it wasn't.

As Pete noted this code should be entirely on the server, not in something the browser can see (like client-side Javascript).

 

[Genimuse]

Something is funky about the way Tek-Tips handled the stuff inside my code tags. It was supposed to say:
[tt]
Request.ServerVariables("HTTPS&quot
[/tt]

 

[MadMango]

Palbano and Genimuse, thanks for the education. Not a very satisfying answer though...

I'm not referring to you, but rather the fact that this can happen in the first place. If I tell someone, "Sure I have a website, it's PhenomQuest.net, check it out." How are they to know to prefix it by HTTP or HTTPS? This is what is burnng me.

 

[Genimuse]

They don't need to know. If it can be accessed by https then it can be accessed via http. No one (and no browser) is going to assume that you have to access a home page via https. Your job, then, as the creator of the site is to redirect them to an https version of the page.

In ASP this code (via an include) at the top of ever page that needs to be secure will ensure that it's not accessed insecurely:

<%
If Request.ServerVariables(&quot;HTTPS&quot;) <> &quot;ON&quot; Then
     Response.Redirect(&quot;[URL unfurl="true"]https://&quot;[/URL] & Request.Servervariables(&quot;PATH_INFO&quot;))
End If
%>

No site that I'm aware of puts its home page under SSL anyway (the https version) because it's so easy to just make all links from there on have an https prefix.

What is the situation you have where this doesn't apply?

 

[MadMango]

Here's the thing...

http://www.phenomquest.net/

is my hobby site.

https://www.phenomquest.net/

is [red]not[/red] my site in any way, shape or form. I stumbled upon it by a fluke.

I was noticing that I was getting a high number of hits, and was trying to figure out why (since it's a small hobby site of mine). I knew word couldn't be spreading that quickly about my site. On my site report, I kept seeing that a lot of people were visiting the site, but only staying for a few seconds. This tipped me off that something strange was going on.

 

[Genimuse]

Hmm. It appears you should talk to your registrar. Somethng is wrong with the way the dns records are setup -- there defiitely should not be two sites like that with ths same URL. Perhaps you've been hacked -- that or one of the registrars haas really screwed up.

 

[smah]

I would say there's a DNS problem somewhere.

Pinging

http://www.phenomquest.net

and

http://www.marino5k.org

return the same IP address and server name. Could these sites be hosted on the same server - kearney.adaptive.net?

 

[MadMango]

Yeah, very screwy. I should be on maggie.adaptive.net

I have contacted my host. It will be interesting to see what their response is. Thanks to all involved.

 

[frozenpeas]

Let us know what they say!

frozenpeas

 

[smah]

Yes, very strange. I have a theory, but can't seem to quite make it happen.

 

[MadMango]

Well, here is thier very lengthy reply...

"We are not seeing this in testing

Bill Sullivan
sales@adaptive.net"

I guess I should start looking for another host.

 

[frozenpeas]

I have found burtonhosting.com to be fantastic

frozenpeas

 

[MadMango]

Thanks for the link frozenpeas, I will take a look. My main problem is that hosting costs come out of my pocket, so I'd like to stay in the price range that I have, which I think is dirt cheap. Perhaps that's part of my problem, you get what you pay for.

$9.95USD a month gets me:
300mb space, 6gb/month bandwidth over OC-3 connection.
10 POP3 Accounts.
Support for ASP, PERL CGI-BIN, PHP Scripting.
Shopping Cart Tools, Sales Reports, SSL, real-time Credit card processing (not that I use these at this time).
Dailiy backups, UPS.

 

[Wullie]

Hi Guys,

The likely cause of this is that you are running on a name based virtual server. This means that the server only has one IP and that the server decides what content to serve by using the request from the browser.

SSL requires a unique IP address for every domain. Because you are running on a server with only 1 IP, any requests to port 443 (SSL), the server looks and sees that it is configured to serve the SSL enabled site, hence different content from your site.

Hope this helps

Wullie

http://www.necomputers.org.uk

http://www.freshlookdesign.co.uk

http://www.freshlookdesign.com

http://www.whiland.co.uk

The pessimist complains about the wind. The optimist expects it to change.
The leader adjusts the sails. - John Maxwell