将$ _SERVER ['HTTPS'] ='on'设置为禁止访问wp-admin

Question

将$ _SERVER ['HTTPS'] ='on'设置为禁止访问wp-admin

- 18
- 15518 2016-12-23
首先,我的服务器位于负载均衡器后面.我的SSL证书位于负载平衡器上,并处理HTTPS.通过端口80上的HTTP,将从端口443上传入的数据转发到Wordpress服务器.

但是,wordpress和php不知道我的服务器配置.这会使浏览器对我有效的SSL证书的有效性产生怀疑.

要解决此问题,我将以下代码添加到functions.php中.我在此处的代码和法典同意.

/** * Make PHP HTTPS aware via HTTP_X_FORWARDED_PROTO */ if(isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https') { $_SERVER['HTTPS']='on'; }

这对于前端非常有用,但是现在即使使用我的Admin帐户也无法访问/wp-admin/.登录后,我收到一条消息,"抱歉,不允许您访问此页面."没有其他帮助.

因此,我在wp-admin文件夹中进行了搜索,发现"抱歉,不允许您访问此页面".出现17次不同的时间.

大多数这些错误消息都与用户权限检查相关联.

如何保持HTTPS开启并保持管理员访问权限?

摘要:

在将HTTP_X_FORWARDED_PROTO逻辑添加到functions.php之前,我可以访问wp-admin/

将HTTP_X_FORWARDED_PROTO逻辑添加到functions.php后,我无法访问wp-admin/

将HTTP_X_FORWARDED_PROTO逻辑删除到functions.php后,我无法访问wp-admin/

更新:

我发现错误消息来自wp-admin/menu.php,而这部分代码位于底部.我在错误的末尾添加了menu.php,以弄清这是该文件.

if ( !user_can_access_admin_page() ) { /** * Fires when access to an admin page is denied. * * @since 2.5.0 */ do_action( 'admin_page_access_denied' ); wp_die( __( 'Sorry, you are not allowed to access this page. menu.php'), 403 ); }

我仍然不知道如何解决此问题.
First off my server is sitting behind a load balancer. My SSL certificate sits on the load balancer and handles HTTPS. The data coming in on port 443 is forwarded to the Wordpress server using HTTP on port 80.

However, wordpress and php do not know my server configuration. This causes the browser to get suspicious about the validity of my valid SSL certificate.

To fix this I added the following code to functions.php. I found this code here and the codex agrees.

/** * Make PHP HTTPS aware via HTTP_X_FORWARDED_PROTO */ if(isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https') { $_SERVER['HTTPS']='on'; }

This works great for the frontend, but now the /wp-admin/ is inaccessible even with my Admin account. After logging in I receive a message, "Sorry, you are not allowed to access this page." No other help is provided.

So I searched through the wp-admin folder and discovered that the words "Sorry, you are not allowed to access this page." appear 17 different times.

Most of these error messages are associated with a user permissions check.

How do I keep HTTPS 'on' and retain admin access?

Summary:

Before adding HTTP_X_FORWARDED_PROTO logic to functions.php I can access wp-admin/

After adding HTTP_X_FORWARDED_PROTO logic to functions.php I cannot access wp-admin/

After removing HTTP_X_FORWARDED_PROTO logic to functions.php I cannot access wp-admin/

UPDATE:

I've discovered that the error message is coming from wp-admin/menu.php and this chunk of code at the bottom. I added menu.php to the end of the error to figure out that it was this file.

if ( !user_can_access_admin_page() ) { /** * Fires when access to an admin page is denied. * * @since 2.5.0 */ do_action( 'admin_page_access_denied' ); wp_die( __( 'Sorry, you are not allowed to access this page. menu.php'), 403 ); }

I still do not understand how to fix this.
php wp-admin permissions ssl https

- 您无需对配置的其余部分说太多.您是否设置了`define('FORCE_SSL_ADMIN',true);`
  
  You dont say much about the rest of your configuration. Did you set `define('FORCE_SSL_ADMIN', true);`
  - 1
  - 2016-12-23
  - user42826
- 我没有定义" FORCE_SSL_ADMIN".我会试试看.
  
  I did not define 'FORCE_SSL_ADMIN'. I will try it.
  - 0
  - 2016-12-24
  - nu everest
- 您需要检查是否也通过HTTP从负载均衡器发送了https cookie.听起来好像没有发送.显然,还需要检查另一种方法,即您设置的Cookie是否通过https传输
  
  you need to check that the https cookies are also sent from the load balancer over http. It sounds like they are not sent. Obviously also the other way around need to be checked, are the cookies that you set are being transferred over https
  - 0
  - 2016-12-24
  - Mark Kaplun

1 个回答

投票数

nu everest · Accepted Answer · 2016-12-24

20

2016-12-24

特别感谢user42826.

根据法典:

如果WordPress托管在提供SSL的反向代理之后,但本身托管却没有SSL,则这些选项最初会将任何请求发送到无限重定向循环中.为了避免这种情况,您可以将WordPress配置为识别HTTP_X_FORWARDED_PROTO标头(假设您已经正确配置了反向代理来设置该标头).

以下操作将解决问题.

将此添加到wp-config.php. (法典参考)

 /* SSL Settings */
define('FORCE_SSL_ADMIN', true);

/* Turn HTTPS 'on' if HTTP_X_FORWARDED_PROTO matches 'https' */
if (strpos($_SERVER['HTTP_X_FORWARDED_PROTO'], 'https') !== false) {
    $_SERVER['HTTPS'] = 'on';
}

由于没有必要,请从functions.php中删除它.

 /**
 * Make PHP HTTPS aware via HTTP_X_FORWARDED_PROTO
 */
if(isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https') {
    $_SERVER['HTTPS']='on';
}

Special thanks to user42826.

According to the codex:

If WordPress is hosted behind a reverse proxy that provides SSL, but is hosted itself without SSL, these options will initially send any requests into an infinite redirect loop. To avoid this, you may configure WordPress to recognize the HTTP_X_FORWARDED_PROTO header (assuming you have properly configured the reverse proxy to set that header).

The following actions will solve the problem.

Add this to wp-config.php. (codex reference)

/* SSL Settings */
define('FORCE_SSL_ADMIN', true);

/* Turn HTTPS 'on' if HTTP_X_FORWARDED_PROTO matches 'https' */
if (strpos($_SERVER['HTTP_X_FORWARDED_PROTO'], 'https') !== false) {
    $_SERVER['HTTPS'] = 'on';
}

Remove this from functions.php as it is unnecessary.

/**
 * Make PHP HTTPS aware via HTTP_X_FORWARDED_PROTO
 */
if(isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https') {
    $_SERVER['HTTPS']='on';
}

原因是安全会话cookie在负载均衡器后面时会丢失,因为LB正在使用SSL,而后端是纯http.很高兴看到其他人在企业级架构上工作；)

The reason is that secure sessions cookies get lost when behind the load balancer because LB is doing SSL but backend is plain http. Nice to see others working on enterprise level architectures ;)
- 1
- 2016-12-24
- user42826
@ user42826这种设置的好处是,如果我想禁止管理员访问,可以将FORCE_SSL_ADMIN注释掉,或者是否有其他副作用使我重新考虑这种思路?

@user42826 What is nice about this setup is that I can just comment out FORCE_SSL_ADMIN if I want to prohibit admin access, or are there other side effects that should cause me to reconsider this line of thinking?
- 0
- 2016-12-24
- nu everest
在您的设置中,听起来好像没有设置FORCE_SSL_ADMIN会阻止管理员访问,但是根据您的要求,有更好的方法来执行此操作.示例:阻止在.htaccess或apache配置中访问wp-admin或wp-login.php,通过插件删除WP本机身份验证,重新架构WP,以使wp-admin URL与公共URL不同,等等.

In your setup, it sounds like not setting FORCE_SSL_ADMIN prevents admin access, but there are better ways to do that depending on your requirements. Examples: prevent wp-admin or wp-login.php access in .htaccess or apache config, remove WP native authentication via plugin, re-architecture WP so that wp-admin url is different than public url, etc
- 1
- 2016-12-25
- user42826
确保在" require_once(ABSPATH.'wp-settings.php');"行之前添加此代码.[特别感谢jtl在此回答.](https://wordpress.stackexchange.com/a/263461/78043)

Make sure to add this code before the `require_once(ABSPATH . 'wp-settings.php');` line. [Special thanks to jtl in this answer.](https://wordpress.stackexchange.com/a/263461/78043)
- 6
- 2017-09-14
- Aaroninus
@Aaroninus谢谢,我使用Cloudflareflexible SSL,如果没有您的评论,我会花时间再次搜索.我之前发现了这个相关问题:https://wordpress.stackexchange.com/questions/170165/wordpress-wp-admin-https-redirect-loop

@Aaroninus thanks, I use Cloudflare flexible SSL and without your comment I would have spent time searching again. I found this related question previously: https://wordpress.stackexchange.com/questions/170165/wordpress-wp-admin-https-redirect-loop
- 0
- 2017-12-21
- baptx
它适用于亚马逊实例.一直在努力将代码移到顶部来完成这项工作.

It worked on amazon instance. Was struggling moving the code to top did the job.
- 0
- 2018-09-11
- Krishnadas PC