Posted By Smuggler on 2/10/2025 10:34 AM

Hi,
I have a dnn website hosted on a shared Windows Server 2022 version 21h2. 
The Database is SQL Server Express 2022 and DNN is version 9.13.3.
The site uses a Let's Encrypt certificate and the website is now always showing up pages as https://.  An url like http:// is redirected to https:// .
The site has recently been moved from another Server.

The site has a login link which shall open a window with fields for username and password in order to login. The problem is that this window is now blank.

If I instead of clicking on the login link, give the url for the browser like url/login the fields for username and password and button for login is displayed but this time not in a new window. Login in this way works fine.

I did also notice that, before the redirect of requests http://url to https://url was set up correctly on the server, I could load the page unsecure with http://url, and then a click on the login link showed the login window normal but with warnings that it was not secure. Later when the redirect of requests http://url to https://url was set up correctly on the server the login window was blank as discribed above.

Before moving the site to the new server all worked fine.

Apart from the not working login link the site works just fine.

What can the cause of the problem be?

Best regards,
Peter

 

 

 

Hello Peter...  Do you have any additional troubleshooting details that you can provide?  For example, do you see any related errors in the browser console window?  What about in the Log4Net log file(s)? 

I have seen this mostly with domains using CloudFlare DNS. A website can be secured from the Browser to CloudFlare Servers but not to the originating server unless an ssl certificate is installed on the originating server. 

This may also take place if you have the page setting to secures pages but site is not.

I have been working on a website with that issue because I don't want people to register or login, I get around by using 2 domains for the same site secondary is  secured the primary is not but it appears secured by using the complementary SSL from CloudFlare. 

My apologies if I am just mumbling. 

 

Hi Will!
Thanks for your input :)
I have looked in the admin logs before without finding anything correlated, but I did not try the browser console before, but just did that ...

In the consol in the browser the text below is found after I clicked on the login link:

JQMIGRATE: Migrate is installed, version 3.4.1      jquery-migrate.js?cdv=48:2

dnn.modalpopup.js?cdv=48:1  Mixed Content: The page at 'https://idea.se/' was loaded over HTTPS, but requested an insecure frame 'http://idea.se/Login?returnurl=/&popUp=true'. This request has been blocked; the content must be served over HTTPS.

I am not sure how to handle the information, can you help me?

/Peter

Follow up,

if I have understood the result from testing with the consol active in the browser described above, the mixed (both https and http) content is not accepted.

The login link in the secure page https tries to load unsecure information via http and therefore the login window is blank.

I do not understand why this occurs now and not before on the other server. Please, anyone who has an explanation or theory, do share!

I have made a test:
In DNN Site settings -> Site behavior -> HTML Page header tags, I added the code below:


With this modification the login link works as expected again.

On the old server I think versions was like this:
Windows Server 2016
SQL Server Express 2019

Best regards,
Peter

I am sorry for my unclear reply above,
here is a new follow up, 

If I have understood the result from testing with the consol active in the browser described above, the mixed content (both https and http) is not accepted. 

The login link in the secure page https tries to load unsecure information via http and therefore the login window is blank. 

I do not understand why this occurs now and not before on the other server. 
Please, anyone who has an explanation or theory, do share! 

I have made a test: 
In DNN Site settings -> Site behavior -> HTML Page header tags, I added the code below: 

With this modification the login link works as expected again. 

On the old server I think versions was like this: 
Windows Server 2016 
SQL Server Express 2019 

Best regards, 
Peter

The code in my reply above wad not saved, new try here:

I have made a test: 
In DNN Site settings -> Site behavior -> HTML Page header tags, I added the code below: 
meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests"

/Peter
 

You may want to review the Tabs table in the database to look for any pages that aren't marked as IsSecure (1). If you have any that you have to change from 0 to 1, you'll need to recycle the website to refresh the cache and allow DNN to enforce the setting.

By the way, there should be a value named `SSLEnforced` in the PortalSettings table. That value should be `True`. Another related setting is `SSLSetup` which should be 2 for this to work as expected. You'd need to refresh the cache again for these values to also take affect.

The tests I have made in my DNN site version 9.13.3:
  
In DNN Site settings -> Site behavior -> HTML Page header tags, I added the code below:  

meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests"

In settings -> Security -> More -> SSL Settings -> setting => off.

With these settings everything works fine. All pages are served as secure https and popup windows for login and editor all works fine.

If the meta tag above is removed the site does not work correctly:

When trying to open a popup window for ex login or html-editor the popup window is blank.

If I change the SSL setting as below:
In settings -> Security -> More -> SSL Settings -> setting => on.

Now instead of showing the site the browser gives the message:

Firefox has detected that the server is redirecting the request for this location in a way that makes completion impossible.

According to our hosting provider the redirects from http to https is now managed by a loadbalancer and not by the site or server as before. It seams to me that this Changes how I must make the settings in DNN.

****************
Will, you wrote about the table Tabs and the field IsSecure, table PortalSettings and the fields SSLEnforced and SSLSetup. I did not yet try those settings. What does SSLSetup do? I have tried to find som documentation regarding the table PortalSettings without success :(

If I understood you correctly I should try to change as follows:

(Perhaps the below changes can be accomplished in the UI in DNN using the setting "Advanced" here: In settings -> Security -> More -> SSL Settings -> setting => Advanced, and then a few more settings ??)

update Tabs
set IsSecure = 1

update PortalSettings
set SSLEnforced = 'true'

update PortalSettings
set SSLSetup = 2

Best regards;
Peter