Try our conversational search powered by Generative AI!

Quan Mai
Jul 7, 2017
  3480
(4 votes)

Commerce Manager over HTTPS with load balancer

Commerce Manager - either you like it or hate it - is still an important part of Commerce, and there are functionalities which can't be found else where, so you will have to stick with it for the time being. And as it's important enough, it's a recommended practice to secure the site with HTTP over SSL - aka HTTPS (Along with other security measures such as put it behind a firewall or limit access to trusted IP only, etc.). However, it might be a problem if you want to put it behind some load balancer. This kind of message can be seen in such scenario (via browser console):

default.aspx:1 Mixed Content: The page at 'https://commercemanager.com/Apps/Shell/Pages/default.aspx' was loaded over HTTPS, but requested an insecure script 'http://commercemanager.com/Apps/Shell/Scripts/Shell/mainLeftTemplate.js?v=10.7.3.0'. This request has been blocked; the content must be served over HTTPS.

Due to your browser configuration, you might not access the site because it blocks the mixed content. While HTTPS is great, mixed content can open doors for attacks like Man in the middle and it's best that browsers disable that by default.

But that can be solved, easily enough, if you:

  • Upgrade your site to at least Commerce 10.6.0, to have this bug https://world.episerver.com/documentation/Release-Notes/ReleaseNote/?releaseNoteId=COM-4220 fixed
  • Configure the header X-Forwarded-Proto to "https" on your load balancer. Because most of the load balancers will redirect to non-HTTPS requests before they reach to ASP.NET (in this case, Commerce Manager), then we need a way to know that the request was on HTTPS or not, to load the assets correctly.

And now your Commerce Manager will be happily working over HTTPS, behind a load balancer.

Jul 07, 2017

Comments

Islam Hamed
Islam Hamed Jan 31, 2019 08:45 PM

Hey Quan,

We are facing this issue now with one of our clients with version 10.4.3.

I just want to confirm if the above 2 solutions have to be done together or either of them? Can we skip the upgrade and only do the load balancer one?

Thanks!

Quan Mai
Quan Mai Feb 1, 2019 07:49 AM

Hi Islam, They should be in together

Please login to comment.
Latest blogs
New Series: Building a .NET Core headless site on Optimizely Graph and SaaS CMS

Welcome to this new multi-post series where you can follow along as I indulge in yet another crazy experiment: Can we make our beloved Alloy site r...

Allan Thraen | Jun 14, 2024 | Syndicated blog

Inspect In Index is finally back

EPiCode.InspectInIndex was released 9 years ago . The Search and Navigation addon is now finally upgraded to support Optimizely CMS 12....

Haakon Peder Haugsten | Jun 14, 2024

Change the IP HTTP Header used for geo-lookup in Application Insights

.

Johan Kronberg | Jun 10, 2024 | Syndicated blog

Copying property values

In this article I’d like to show simple Edit Mode extension for copying property values to other language versions. In one of my previous blogposts...

Grzegorz Wiecheć | Jun 8, 2024 | Syndicated blog