Forcing HTTPS on login and checkout in Zend Framework

How we sent only sensitive pages over HTTPS in 2012, and why today the answer is simply “everywhere”.

23 January 2012 · 1 min read

From the archive: first published on mohamedsharaf.net in January 2012. Rewritten and checked in 2026; some details may be out of date.

In 2012, HTTPS was expensive enough that many sites used it only where it mattered: login, cart and checkout. In Zend Framework 1 we did it with a front-controller plugin that read a list of secure pages from a config file:

; ssl.ini
ssl.modules.default.require_ssl = false
ssl.modules.default.controllers.account.require_ssl = true
ssl.modules.default.controllers.checkout.require_ssl = true

The plugin checked each request against that list in preDispatch() and redirected to the https:// address when needed (and back to http:// elsewhere).

Today: don’t do this. Certificates are free, HTTPS costs almost nothing, and mixing HTTP and HTTPS leaks session cookies. Serve the whole site over HTTPS, redirect all HTTP to it, and send an HSTS header so browsers never try plain HTTP again.