Setting only SSL_Login does not force SSL Login

[ccolotti]

I have notcied on 3.3 multi-site if Force_SSL_Login only is set it is actually not redirected to SSL. Only when BOTH force SSL_admin and SSL_Login are set do you get the SSL login page. I am running the default multi-site .htacess as specified by the multisite setup. I am not sure if that needs to be modified, but it never had to be changed before 3.3

[kurtpayne]

I can reproduce this in multisite and single site on 3.3.1. Patch 19723.patch​ forces an SSL login if the FORCE_SSL_LOGIN constant is set in wp-config.php regardless of FORCE_SSL_ADMIN.

One note: If FORCE_SSL_ADMIN is true, the URL returned from wp_login_url() (e.g. the "Log in" link in the sidebar in twentyeleven) will always be SSL, regardless of my patch. This seems like a minor impact, but it should be noted that front-end users will login over SSL even when FORCE_SSL_LOGIN is not set.

[nacin]

FORCE_SSL_LOGIN only forces that the credentials get sent over HTTPS, not the accessing of wp-login.php itself. If you want everything to be SSL you should set FORCE_SSL_ADMIN.

[ccolotti]

Replying to nacin:

FORCE_SSL_LOGIN only forces that the credentials get sent over HTTPS, not the accessing of wp-login.php itself. If you want everything to be SSL you should set FORCE_SSL_ADMIN.

That makes sense. One would think that switch would at least just make the login page also SSL so you know you are secure. I know it is SENT over SSL when you submit.

[ryan]

This is done as part of the support for allowing logins over https or http. Visiting wp-login.php via https results in SSL-only cookies and redirection to the https admin. Visiting wp-login.php via http results in non-SSL cookies and redirection to the http admin. Currently, those who want wp-login.php to always be delivered over SLL must FORCE_SSL_ADMIN or use a plugin.

[iandunn]

Looks like this is actually a duplicate of #10267, which has a commit now.