disable https in backoffice

[Former Member]

Hey Experts,

I'm currently disabling the https redirect so the backoffice can be used in http.

The thing is the productcockpit doesnt look good, he cant open some css files for example "/_coc_modules.css". This file is inside the header and when i'm clicking on it inside the backoffice it shows me this:

HTTP Status 405 - HTTP method GET is not supported by this URL

type Status report

message HTTP method GET is not supported by this URL

description The specified HTTP method is not allowed for the requested resource. Any ideas why he's not able to open that file? Cheers, Daniel

[Former Member]

It does seems like he isn't using the BackofficeCOCExtensionCssLocator when logging in with http and not https any ideas why?

[agrabovskis]

Why would you bother removing HTTPS? Such requirement makes the solution no-secure since allows to sniff the credentials or hijack the session. On top of that it requires some security XML changes in the standard extensions - not something you would want to do in standard scenario.

[Former Member]

because the https certificate isn't there yet from customer side. So they want it first to keep it at http.

[agrabovskis]

If it is for temporary use, then you can set up reverse proxy in front of Hybris and make Hybris "think" that the traffic is SSL-ed, while not forcing to switch to "HTTPS" in the proxy.

[Former Member]

Hey Arvids thanks for your answer. I'll have a look on that since it's only temporary