PHP-FPM $_SERVER['HTTPS'] variable

Sunka · Jan 13, 2017

Please fill in any relevant information that applies to you:

Centmin Mod Version Installed: 123.09beta01

Nginx Version Installed: 1.11.8

PHP Version Installed: 7.1

MariaDB MySQL Version Installed: 10.1.20

When was last time updated Centmin Mod code base ? : today

Under the PHP Variables section on my phpinfo.php page, variable $_SERVER['HTTPS'] is set to OFF, but my forum and all on server is on https.
I also tried to add $_SERVER['HTTPS'] = 'on'; in my library/config.php file of XenForo forum, but still no luck.

I google for that problem and found this:
A typical Nginx setup uses fastcgi_pass directives to pass the request to the PHP-FPM daemon. If you would be running an Apache setup, Apache would automatically set the HTTPS server variable, that PHP code can check via $_SERVER['HTTPS'] to determine if the request is HTTP or HTTPs.

In fact, that's how most CMS's (WordPress, Drupal, ...) determine the server environment. They'll also use it for redirects from HTTP-to-HTTPs or vica versa, depending on the config. So the existence of the $_SERVER['HTTPS'] variable is pretty crucial.

Nginx doesn't pass the variable by default to the PHP-FPM daemon when you use fastcgi_pass, but it is easily added.

A basic example in Nginx looks like this.
Code:
include fastcgi_params;
fastcgi_split_path_info ^(.+\.php)(.*)$;
fastcgi_index  index.php;
fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;

# Check if the PHP source file exists (prevents the cgi.fix_pathinfo=1 exploits)
if (-f $request_filename) {
    fastcgi_pass   backend_php; # This backend is defined elsewhere in your Nginx configs
}
The example above is a classic one, that just passes all to PHP. In order to make PHP-FPM aware of your HTTPs setup, you need to add a fastcgi_param environment variable to the config.
Code:
include fastcgi_params;
fastcgi_split_path_info ^(.+\.php)(.*)$;
fastcgi_index  index.php;
fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;

# Make PHP-FPM aware that this vhost is HTTPs enabled
fastcgi_param  HTTPS 'on';

# Check if the PHP source file exists (prevents the cgi.fix_pathinfo=1 exploits)
if (-f $request_filename) {
    fastcgi_pass   backend_php; # This backend is defined elsewhere in your Nginx configs
}
The solution is in the fastcgi_param HTTPS 'on'; line, which passes the HTTPS variable to the PHP-FPM daemon.
Click to expand...
Is that a good solution?

eva2000 · Jan 13, 2017

I believe it's already done in Centmin Mod Nginx / php-fpm via 2 variables in /usr/local/nginx/conf/php.conf
Code (Text):
fastcgi_param  HTTPS              $https if_not_empty;
and
Code (Text):
fastcgi_param HTTPS $server_https;
with nginx.conf include file
Code (Text):
include /usr/local/nginx/conf/fastcgi_param_https_map.conf;
contents
Code (Text):
# auto detect and enable fastcgi_param HTTPS $server_http
# for PHP behind SSL https

map $scheme $server_https {
        default off;
        https on;
}
it only shows as on in phpinfo if you access phpinfo url from https otherwise if you access via non-https it shows off

Sunka · Jan 13, 2017

Aha, so it is https
Yep, I tried to open phpinfo with https and it is show ON.

So, conclusion, server is HTTPS?
I can sleep in peace?

eva2000 · Jan 13, 2017

Sunka said: ↑

So, conclusion, server is HTTPS?
I can sleep in peace?
Click to expand...

yup

Log in / Register

Forums

Join the community today

PHP-FPM $_SERVER['HTTPS'] variable

Sunka Well-Known Member

eva2000 Administrator Staff Member

Sunka Well-Known Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Join the community today

PHP-FPM $_SERVER['HTTPS'] variable

Sunka Well-Known Member

eva2000 Administrator Staff Member

Sunka Well-Known Member

eva2000 Administrator Staff Member

.