Alejandro Napoles

Alejandro Napoles


Thoughts and ideas about programming, technology and my life as a lifelong learner and developer.

Share


Tags


Twitter


Ghost with HTTPS

Alejandro NapolesAlejandro Napoles

After I configured HTTPS on the server and deployed the Ghost blog, I started receiving mixed content errors on the blog. These errors were caused by Ghost serving subresources with HTTP content, therefore weakening the security of the entire page:

As these requests are vulnerable to man-in-the-middle attacks, where an attacker eavesdrops on a network connection and views or modifies the communication between two parties. Using these resources, an attacker can often take complete control over the page, not just the compromised resource.

Initially I thought the only thing I needed to do was changing the url in the Ghost config file, as this guide recommended, to make it use the HTTPS one. But it didn't fixed the errors.

Reading more into the official documentation I found that I needed to add the urlSSL parameter to the config file. It is also necessary to use the forceAdminSSL parameter, this allows us to force SSL for the administration interface:

urlSSL: "https://alejandronapoles.com",
forceAdminSSL: true
Comments