I've thought it is done by modifying .htaccess file, but it is not. Making changes to the "force https" option doesn't change the .htaccess file. Can someone explain to me what is the mechanism behind Joomla's "force https" setting in the Global Configuration?
It is handled within the SiteRouter class in Joomla, more specifically in its parse() method where the following condition changes the scheme part of the URI if force_ssl property of the application is set that way and then redirect it:
if ($this->app->get('force_ssl') == 2 && strtolower($uri->getScheme()) !== 'https')
{
// Forward to https
$uri->setScheme('https');
$this->app->redirect((string) $uri, 301);
}
More info on SiteRouter class is here: https://api.joomla.org/cms-3/classes/Joomla.CMS.Router.SiteRouter.html
-
Just for completeness this is indeed what forces a redirect when someone ends up on a http url. The route builder also has logic setup to enforce https connections which is used directly in some components: github.com/joomla/joomla-cms/blob/staging/libraries/src/Router/… – George Wilson Dec 15 '20 at 21:42
-
Sample code for user activation which uses this flag github.com/joomla/joomla-cms/blob/… – George Wilson Dec 15 '20 at 21:43
