# Issue with https and cache

**URL:** <https://forum.getkirby.com/t/issue-with-https-and-cache/20205>\
**Category:** Questions\
**Tags:** v3\
**Created:** [November 30, 2020, 12:24pm UTC](https://forum.getkirby.com/t/issue-with-https-and-cache/20205 "2020-11-30T12:24:09Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![BenjaminB](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/benjaminb/32/12780_2.png) [@BenjaminB](https://forum.getkirby.com/u/BenjaminB)\
**Post date:** [November 30, 2020, 12:24pm UTC](https://forum.getkirby.com/t/issue-with-https-and-cache/20205/1 "2020-11-30T12:24:09Z")

</div>

Hello,  
I don’t understand why but i get an issue when cache is active and https forced.  
The both work fine separately but when i try to apply cache and to redirect http requests to https, only pages are correctly redirected to https, all assets like image, js and css files css are called via a http url and browsers block all those request.  
I apply https redirection via htaccess, from the “Kirby secrets repo” and use simple cache configuration from the official documentation.  
I tried to declare url in config.php but i had the same result…

Some one get an idea ?  
Thanks.

---

<div class="post-metadata">

**Author:** ![Adspectus](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/adspectus/32/189_2.png) [@Adspectus](https://forum.getkirby.com/u/Adspectus)\
**Post date:** [November 30, 2020, 12:52pm UTC](https://forum.getkirby.com/t/issue-with-https-and-cache/20205/2 "2020-11-30T12:52:37Z")

</div>

Welcome BenjaminB 👋,

can you post your `.htaccess` here?

Do you have access to a (apache) server config or are you only allowed to apply statements in your `.htaccess`?

---

<div class="post-metadata">

**Author:** ![BenjaminB](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/benjaminb/32/12780_2.png) [@BenjaminB](https://forum.getkirby.com/u/BenjaminB)\
**Post date:** [November 30, 2020, 1:02pm UTC](https://forum.getkirby.com/t/issue-with-https-and-cache/20205/3 "2020-11-30T13:02:20Z")

</div>

Hi @Adspectus  
Thanks for reply.  
I don’t have any access to the apache config, the website will be hosted on an shared server.  
This my htaccess :

```
# Kirby .htaccess

# rewrite rules
<IfModule mod_rewrite.c>

# enable awesome urls. i.e.:
# http://yourdomain.com/about-us/team
RewriteEngine on

# Redirect non www to www and Force https
RewriteCond %{HTTP_HOST} !=localhost
RewriteCond %{HTTP_HOST} ^www\. [NC,OR]
RewriteCond %{HTTPS} off
RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [R=301,L,NE]

# make sure to set the RewriteBase correctly
# if you are running the site in a subfolder;
# otherwise links or the entire site will break.
#
# If your homepage is http://yourdomain.com/mysite,
# set the RewriteBase to:
#
# RewriteBase /mysite

# In some environments it's necessary to
# set the RewriteBase to:
#
RewriteBase /

# block files and folders beginning with a dot, such as .git
# except for the .well-known folder, which is used for Let's Encrypt and security.txt
RewriteRule (^|/)\.(?!well-known\/) index.php [L]

# block all files in the content folder from being accessed directly
RewriteRule ^content/(.*) index.php [L]

# block all files in the site folder from being accessed directly
RewriteRule ^site/(.*) index.php [L]

# block direct access to Kirby and the Panel sources
RewriteRule ^kirby/(.*) index.php [L]

# make site links work
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*) index.php [L]

</IfModule>

# pass the Authorization header to PHP
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

# compress text file responses
<IfModule mod_deflate.c>
AddOutputFilterByType DEFLATE text/plain
AddOutputFilterByType DEFLATE text/html
AddOutputFilterByType DEFLATE text/css
AddOutputFilterByType DEFLATE text/javascript
AddOutputFilterByType DEFLATE application/json
AddOutputFilterByType DEFLATE application/javascript
AddOutputFilterByType DEFLATE application/x-javascript
</IfModule>
```

---

<div class="post-metadata">

**Author:** ![pixelijn](https://avatars.discourse-cdn.com/v4/letter/p/7ab992/32.png) [@pixelijn](https://forum.getkirby.com/u/pixelijn)\
**Post date:** [November 30, 2020, 1:27pm UTC](https://forum.getkirby.com/t/issue-with-https-and-cache/20205/4 "2020-11-30T13:27:41Z")

</div>

Have you cleared your browser cache after applying these rules?

---

<div class="post-metadata">

**Author:** ![BenjaminB](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/benjaminb/32/12780_2.png) [@BenjaminB](https://forum.getkirby.com/u/BenjaminB)\
**Post date:** [November 30, 2020, 1:30pm UTC](https://forum.getkirby.com/t/issue-with-https-and-cache/20205/5 "2020-11-30T13:30:35Z")

</div>

Hi @pixelijn  
Thanks for reply.  
It was my first direction…  
I tried in private mode, after cache clearing and even in an another browser…  
Same results. Each time.

---

<div class="post-metadata">

**Author:** ![pixelijn](https://avatars.discourse-cdn.com/v4/letter/p/7ab992/32.png) [@pixelijn](https://forum.getkirby.com/u/pixelijn)\
**Post date:** [November 30, 2020, 1:33pm UTC](https://forum.getkirby.com/t/issue-with-https-and-cache/20205/6 "2020-11-30T13:33:48Z")

</div>

> [@BenjaminB](#):
>
> `RewriteBase /`

Have you tried without setting the RewriteBase?

---

<div class="post-metadata">

**Author:** ![BenjaminB](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/benjaminb/32/12780_2.png) [@BenjaminB](https://forum.getkirby.com/u/BenjaminB)\
**Post date:** [November 30, 2020, 1:40pm UTC](https://forum.getkirby.com/t/issue-with-https-and-cache/20205/7 "2020-11-30T13:40:10Z")

</div>

Just at the moment… but it’s not working…  
The problem stay the same.

---

<div class="post-metadata">

**Author:** ![Adspectus](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/adspectus/32/189_2.png) [@Adspectus](https://forum.getkirby.com/u/Adspectus)\
**Post date:** [November 30, 2020, 1:48pm UTC](https://forum.getkirby.com/t/issue-with-https-and-cache/20205/8 "2020-11-30T13:48:35Z")

</div>

Your rules seem to be working well and since you mentioned your problem is only with assets and media, there might be something else which interfere. You did not hard code “`http://...`” in your pages, did you? Are you using some kind of proxy, CDN or load balancer or is your provider doing so? Could you reveal the URL to your site to check for us?

---

<div class="post-metadata">

**Author:** ![BenjaminB](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/benjaminb/32/12780_2.png) [@BenjaminB](https://forum.getkirby.com/u/BenjaminB)\
**Post date:** [November 30, 2020, 1:56pm UTC](https://forum.getkirby.com/t/issue-with-https-and-cache/20205/9 "2020-11-30T13:56:26Z")

</div>

Helas, for now i can’t. Work is in progress and url is confidential.  
But i’m sure i had not harcoded url any where, i had only use kirby method like css(), toImages()-\>url(), etc…  
I will check if provider apply CDN or something like that but i dont think so.

---

<div class="post-metadata">

**Author:** ![BenjaminB](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/benjaminb/32/12780_2.png) [@BenjaminB](https://forum.getkirby.com/u/BenjaminB)\
**Post date:** [November 30, 2020, 2:01pm UTC](https://forum.getkirby.com/t/issue-with-https-and-cache/20205/10 "2020-11-30T14:01:45Z")

</div>

No.  
No CDNs, no DNS weird stuff, no redirections…

---

<div class="post-metadata">

**Author:** ![pixelijn](https://avatars.discourse-cdn.com/v4/letter/p/7ab992/32.png) [@pixelijn](https://forum.getkirby.com/u/pixelijn)\
**Post date:** [November 30, 2020, 4:03pm UTC](https://forum.getkirby.com/t/issue-with-https-and-cache/20205/11 "2020-11-30T16:03:23Z")

</div>

And you are not using any plugins either that might interfere? And what is your Kirby version?

---

<div class="post-metadata">

**Author:** ![BenjaminB](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/benjaminb/32/12780_2.png) [@BenjaminB](https://forum.getkirby.com/u/BenjaminB)\
**Post date:** [November 30, 2020, 4:33pm UTC](https://forum.getkirby.com/t/issue-with-https-and-cache/20205/12 "2020-11-30T16:33:24Z")

</div>

I use the 3.4.2 version with only few plugins : commentions, k3-image-clip, kirby builder and editor…  
Those plugins seems me stables and i’m not sur they could be reponsibles.

---

<div class="post-metadata">

**Author:** ![BenjaminB](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/benjaminb/32/12780_2.png) [@BenjaminB](https://forum.getkirby.com/u/BenjaminB)\
**Post date:** [November 30, 2020, 4:35pm UTC](https://forum.getkirby.com/t/issue-with-https-and-cache/20205/13 "2020-11-30T16:35:07Z")

</div>

Well, k3-image-clip work around images, but that not justify errors on others assets like css an js files… no ?

---

<div class="post-metadata">

**Author:** ![texnixe](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/texnixe/32/5754_2.png) [@texnixe](https://forum.getkirby.com/u/texnixe)\
**Post date:** [November 30, 2020, 7:44pm UTC](https://forum.getkirby.com/t/issue-with-https-and-cache/20205/14 "2020-11-30T19:44:40Z")

</div>

May I suggest that you first update to the current version (3.4.4), so that we make sure that we are not trying to hunt down a possible bug that has long been fixed. You might also want to try with the pre-released 3.5.

If the issue is still there after the update, we can look further.

---

<div class="post-metadata">

**Author:** ![rasteiner](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/rasteiner/32/4788_2.png) [@rasteiner](https://forum.getkirby.com/u/rasteiner)\
**Post date:** [December 1, 2020, 7:58am UTC](https://forum.getkirby.com/t/issue-with-https-and-cache/20205/15 "2020-12-01T07:58:01Z")

</div>

If updating doesn’t help…

You mentioning the fact that both things (cache & https redirection) work alone, but not together, makes me think that kirby is at a certain point caching pages that contain `http://`.

I guess you already tried deleting your _server_ cache? (I’ve only read “browser cache” in this thread). If not, I’d try that.  
After deleting the server cache, please test if it’s working by **first** going to the http (not https) route and let it redirect, otherwise you might get a “false positive” in subsequent tests.

If that doesn’t help (or you already tried), my other hypothesis would be that kirby caches the “redirect page”. I’ll explain myself:  
I’m not 100% sure how the mod\_rewrite redirect works, but I’m beginning to think that it “just adds headers”. That would mean that your first http request is actually being redirected with a normal kirby page (at that point serving http) and some headers added by mod\_rewrite - since this is the first time kirby renders the page, it also keeps the output and puts that into the cache (with all the `http://` links). Then the browser follows the redirect header and asks for the https version, kirby looks at the cache and, since it doesn’t distinguish between http and https versions, happily serves you the cached http variant it just created in the first request that no-one actually saw.

You can test this hypothesis by refusing to _ever_ serve kirby pages over http. You could do this by putting something like the following code to the top of your index.php (it has to be before the `new Kirby` call):

```php
if(empty($_SERVER['HTTPS']) || $_SERVER['HTTPS'] == 'off') {
  die('cannot serve http');
}

// here follows the normal kirby stuff

```

Then, once again, delete your server cache, and try going to a http:// route.

---

<div class="post-metadata">

**Author:** ![BenjaminB](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/benjaminb/32/12780_2.png) [@BenjaminB](https://forum.getkirby.com/u/BenjaminB)\
**Post date:** [December 1, 2020, 10:49am UTC](https://forum.getkirby.com/t/issue-with-https-and-cache/20205/16 "2020-12-01T10:49:44Z")

</div>

Thanks @texnixe and @rasteiner for your replies.  
The rasteiner’s solution was the one. I had to manually clear the cache folder content on the server.  
I supposed this folder was automatically cleared when i was activating and disabling cache… but not.  
Thank you all, you rock ! 🙂

---

<div class="post-metadata">

**Author:** ![rasteiner](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/rasteiner/32/4788_2.png) [@rasteiner](https://forum.getkirby.com/u/rasteiner)\
**Post date:** [December 1, 2020, 11:04am UTC](https://forum.getkirby.com/t/issue-with-https-and-cache/20205/17 "2020-12-01T11:04:30Z")

</div>

I’m actually kinda surprised nr. 1 did it. I would have bet on nr. 2 😲

However I think someone could / should investigate if cache doesn’t create problems in situations where people want to use both http and https to serve content, because it really would seem like [Kirby doesn’t distinguish between the two when caching a page](https://github.com/getkirby/kirby/blob/3.4.4/src/Cms/Page.php#L286), and that would be a problem when a cached http version is served to a https request

---

<div class="post-metadata">

**Author:** ![texnixe](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/texnixe/32/5754_2.png) [@texnixe](https://forum.getkirby.com/u/texnixe)\
**Post date:** [December 1, 2020, 11:18am UTC](https://forum.getkirby.com/t/issue-with-https-and-cache/20205/18 "2020-12-01T11:18:12Z")

</div>

In my quick test, some URLs were cached with the protocol, some without. Interestingly, those created with the css/js helpers without, but page urls with protocol. That is a bit weird, considering that assets didn’t work.

---

<div class="post-metadata">

**Author:** ![BenjaminB](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/benjaminb/32/12780_2.png) [@BenjaminB](https://forum.getkirby.com/u/BenjaminB)\
**Post date:** [December 1, 2020, 11:56am UTC](https://forum.getkirby.com/t/issue-with-https-and-cache/20205/19 "2020-12-01T11:56:10Z")

</div>

This is also what I saw once the cache and redirects were activated: the urls of the pages were updated in cache folders, but not those of assets like js, css, imgs …  
I could see that the cache was managed domain by domain in the cache folder, maybe a lead would be to integrate the protocol in the name of the folders?

Anyway, thanks again for your help.

---

<div class="post-metadata">

**Author:** ![rasteiner](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/rasteiner/32/4788_2.png) [@rasteiner](https://forum.getkirby.com/u/rasteiner)\
**Post date:** [December 1, 2020, 12:00pm UTC](https://forum.getkirby.com/t/issue-with-https-and-cache/20205/20 "2020-12-01T12:00:39Z")

</div>

> [@texnixe](#):
>
> In my quick test, some URLs were cached with the protocol, some without

strange… Is that on 3.5?  
I’ve just tried 3.4.4 starterkit, and it caches everything with protocol for me. And if you get a browser to actually load an http page (and not automatically change your url to https [chrome and firefox seem to do that now]) when no cache exists yet, kirby caches the http version and serves that to everyone from that moment on.

[Next page](https://forum.getkirby.com/t/issue-with-https-and-cache/20205.md?page=2)
