Our website is using Force SSL on all pages. There is a massive issue that whenever a HTTP url is requested, the session is lost and the user is logged out, even though they are still redirected to the HTTPS page.

This is really frustrating and I don't see why HTTPS sessions are lost just because an HTTP URL is requested and redirected to the HTTPS version. Any ideas?

1 Answer 1


Just found that this is a known issue as https redirection is done in the routing- after the session is instantiated - https://github.com/joomla/joomla-cms/issues/4960

A simple fix is to use https redirection in .htaccess

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301] 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.