YOURLS_SITE value for http and https?

[tessus]

This is not a bug report, but a question.

I currently run my YOURLS instance on http, but want to make it available on https as well.
Please note that I do not want to redirect all http traffic to https. I want that YOURLS is available on http and https!

The YOURLS_SITE variable seems to require a scheme.

So here's my question: how do I set this up?

[ozh]

Just define ('YOURLS_SITE', 'https://sho.rt/'); instead of 'http://sho.rt' if you want to default to be the https version of your site

[tessus]

Thanks, but that doesn't work. I want both running at the same time. If I change it to define ('YOURLS_SITE', 'https://sho.rt/');, the instance on http stops working. (I tried this before and ran into a lot of issues.)

Ok, let me test this again..

[ozh]

Actually YOURLS doesn't really care about your server config. All this is just server setup, what you define in YOURLS is specific behavior regarding HTTPS if enabled. Nothing more.

See for instance yourls.org, which is available both on http and https :

define('YOURLS_SITE', 'http://yourls.org');
define('YOURLS_ADMIN_SSL', true);

You can go to http://yourls.org or https://yourls.org, follow short links such as http://yourls.org/ds or https://yourls.org/ds, but http://yourls.org/admin/ (or any page under "admin") redirects you to https://yourls.org/admin/

Again, this is server related stuff. YOURLS doesn't care (and doesn't dictate how the server will run)

[tessus]

Thank you very much for the detailed explanation. I believe I had the following issue:

I wanted to use SSL/TLS for my api access. But when I created a new short link, the link returned was with the scheme https.
(Browser plugins copy the short URL to the clipboard, or when you use the public interface you would have to manually change it when you paste this link for others.)

While SSL/TLS is important for API access or the admin interface, it is totally unnecessary for following short urls. The TLS negotiation takes time only to do a simple redirect right after, this IMO no need to use TLS.

Thanks again. I will run my tests again. If I still run into the same problem, maybe I can solve this with a plugin. (The plugin would basically have to return an http scheme exclusively).

[tessus]

@PopVeKind this sounds interesting. I'll be on vacation soon (next week), thus I will have more time to look into it.

I was thinking about setting a protocol-relative URL as well, but I didn't know if YOURLS supported it.
Also, thanks for the offer. I'll ping you should I have to go with the patch to split the constant. Let me try to get it done w/o the patch first.

[PopVeKind]

@tessus

I wanted to use SSL/TLS for my api access. But when I created a new short link, the link returned was with the scheme https.

In the admin pages, the shortened URL uses the protocol from YOURLS_SITE.

HTTP Example:
define('YOURLS_SITE', 'http://ti.ny'); // http

This would cause short URLs (links) made with the admin pages to use http. I believe the api would work the same.

If your short URLs were made with the https protocol it is because of the protocol in YOURLS_SITE

HTTPS Example:
define('YOURLS_SITE', 'https://cu.te'); // https

To force https for your admin pages add:
define('YOURLS_ADMIN_SSL', true);

[PopVeKind]

@tessus

What YOURLS receives is based solely on what your server delivers it. That is, how your server directs it.

In fact, the only part of the shortened URL that is saved in the DB is the keyword. Of a short URL like http://ti.ny/ABC, the keyword is the "ABC" part.

Consider that you use server settings to deliver http and/or https requests to the YOURLS program. Once there the YOURLS program just uses the keyword!

My Production Server has 5 domains running on one YOURLS multisite. The same 5 domains are also running on one WordPress multisite. Both WordPress and YOURLS are in their own directory, and both are addressed in the document root. This is great because keywords that do not exist in YOURLS are redirected automatically to the default page of my WordPress site on the same domain name!

I have decided to use the Encryption Everywhere philosophy. Therefore everything will be rigged for https. For my purpose, I think this is best for me. Anything that arrives at my server as http, for WordPress, will be 301 redirected to https. Anything (http or https) arriving in the YOURLS format for redirection will be redirected by YOURLS immediately to the long URL. I see no advantage to redirect this to either http or https. Any http request arriving for the admin area of YOURLS will be redirected using https. If you notice, by using server settings I avoid setting YOURLS_ADMIN_SSL - and that lightens my PHP server load ever so slightly. (No Code is faster than No Code!)

Bottomline, Wordpress and YOURLS Admin are forced to use SSL and https. YOURLS Short URLs May use https or May use http. I plan to publish the https version of short URLs (even though it is one character longer). Likewise, I will force no www. on WordPress and YOURLS Admin. Short YOURLS will be published without www too. But requests for short URLs with a www. will be honored and processed without delay nor redirection based on protocol or www.

The idea is to make YOURLS and WordPress as efficient as possible. However, the day is fast approaching that Google Chrome will be released defaults to https instead of http. And browsers will block http sites! So if people say, "My webpage is ti.ny/tim and type it in a browser, the programmer will be uncertain if the request will arrive as https or http.

My friend is using YOURLS and WordPress, both in multisite mode, strictly in http (no SSL).

Our other friend is also building a YOURLS and WordPress multisite that is all http _except_ the YOURLS admin is running in https.

Exciting things are coming!

[tessus]

@PopVeKind usually I run everything on my servers with https and if something comes in as http it will be redirected to https.

However, I do not wan't people having to wait for TLS negotiation, just to be redirected anyway
(yourls instance to long url).

Yes, I know, this is marginal, but I'm a performance guy and I like to handle requests as efficiently as possible.

[tessus]

Success !!!

Here are my results:

I've additionally activated TLS for my YOURLS instance and set the following in my config.php:

define('YOURLS_SITE', 'http://sho.rt');
define('YOURLS_ADMIN_SSL', true);

Even though I use https://sho.rt/yourls-api.php to shorten my URLs via the API, the returned shortened URLs start with http://

[gnanet]

Just a side note, (which may be not accurate, because i could not debug my exact issue, but) I use URLy for sending url-s to be shortened over API, and after i moved to https, and generated short urls starting with https, the URLy program throws only some error, but if i configured to respond with http urls the URLy program has no issues.

[sripriyesha]

as of version 1.7.9
the simplest way is to go to user/config.php where YOURLS is installed
and add

define( 'YOURLS_ADMIN_SSL', true );