Quan Mai
Jul 7, 2017
  3071
(4 votes)

Commerce Manager over HTTPS with load balancer

Commerce Manager - either you like it or hate it - is still an important part of Commerce, and there are functionalities which can't be found else where, so you will have to stick with it for the time being. And as it's important enough, it's a recommended practice to secure the site with HTTP over SSL - aka HTTPS (Along with other security measures such as put it behind a firewall or limit access to trusted IP only, etc.). However, it might be a problem if you want to put it behind some load balancer. This kind of message can be seen in such scenario (via browser console):

default.aspx:1 Mixed Content: The page at 'https://commercemanager.com/Apps/Shell/Pages/default.aspx' was loaded over HTTPS, but requested an insecure script 'http://commercemanager.com/Apps/Shell/Scripts/Shell/mainLeftTemplate.js?v=10.7.3.0'. This request has been blocked; the content must be served over HTTPS.

Due to your browser configuration, you might not access the site because it blocks the mixed content. While HTTPS is great, mixed content can open doors for attacks like Man in the middle and it's best that browsers disable that by default.

But that can be solved, easily enough, if you:

  • Upgrade your site to at least Commerce 10.6.0, to have this bug https://world.episerver.com/documentation/Release-Notes/ReleaseNote/?releaseNoteId=COM-4220 fixed
  • Configure the header X-Forwarded-Proto to "https" on your load balancer. Because most of the load balancers will redirect to non-HTTPS requests before they reach to ASP.NET (in this case, Commerce Manager), then we need a way to know that the request was on HTTPS or not, to load the assets correctly.

And now your Commerce Manager will be happily working over HTTPS, behind a load balancer.

Jul 07, 2017

Comments

Islam Hamed
Islam Hamed Jan 31, 2019 08:45 PM

Hey Quan,

We are facing this issue now with one of our clients with version 10.4.3.

I just want to confirm if the above 2 solutions have to be done together or either of them? Can we skip the upgrade and only do the load balancer one?

Thanks!

Quan Mai
Quan Mai Feb 1, 2019 07:49 AM

Hi Islam, They should be in together

Please login to comment.
Latest blogs
Optimizely PIM - Variant Management Overhaul & Rollout

Optimizely Product Information Management has completely overhauled variant management with improved usability and support for variant swatches. In...

Arthur Vander Voort | Feb 1, 2023

How Optimizely Web Experimentation enables fast validation of design and UX changes

Ever wondered how to increase conversion rates and quickly validate design/UX alternatives to find the most impactful changes? I wrote a practical...

Jacob Pretorius | Jan 31, 2023

What’s next after Google Optimize’s sunsetting?

Google has announced that it is sunsetting the Google Optimize and Optimize 360 services, forcing customers to explore new platforms and invest in...

Ynze | Jan 31, 2023 | Syndicated blog

What’s next after Google Optimize’s sunsetting?

Google has announced that it is sunsetting the Google Optimize and Optimize 360 services, forcing customers to explore new platforms and invest in...

Ynze | Jan 31, 2023 | Syndicated blog