Redirect loop when using HSTS

[KaiS]

Hi there,

 

I don't know if it is really a bug, so I am posting it here.

Currently it seems to be impossible to set the "WHMCS SSL System URL" in the "General Settings" tab while having HSTS enabled.

 

The Problem seems to be that WHMCS tries to use HTTPS only for certain sites, but HSTS forces to redirect the browser to use HTTPS (when visited the site once via HTTPS) which cause a redirect loop.

 

Disabling HSTS solves the problem, if the users know how to remove the HSTS settings in their browser (For example chrome://net-internals/#hsts). Another solution is to remove the SSL URL in WHMCS, which is not really what I do prefer.

 

(There was no .htaccess in place.)

 

- - - Updated - - -

 

As a sidenote when having "HSTS" and the "SSL URL" enabled, the areas of WHMCS which actually use SSL like 'serverstatus.php' still work since they don't redirect to HTTP.

[tsiedsma]

I had the same issue with HSTS, just update your config like this:

imgforyou.com/i/Xpa.png

[KaiS]

I know that it works then but that causes people who don't use https at the begining (or another time) to stay on http.

I set a redirect to https in apache, it does what I want.

 

I just wanted to post this so maybe others can find this info. Or maybe they change something about the behavior of this SSL URL field.