This very tiny plugin puts October in HTTPS protocol correctly when behind the Cloudflare reverse proxy in full or flexible SSL mode. In addition, it ensures IP detection functions as expected when using Cloudflare in conjunction with a load balancer.
Cloudflare Rocket Loader rewrites script tags to defer their execution, which can break scripts that depend on a strict loading order, including the October CMS backend and AJAX framework. This plugin marks every rendered script tag with the data-cfasync="false" attribute, instructing Rocket Loader to leave them untouched.
Protection is applied to the backend area by default, where the script loading order is critical. The frontend is left untouched so Rocket Loader can keep optimizing theme scripts, and if your theme is affected, enable the frontend protection using the configuration below.
Puts October CMS in the HTTPS protocol correctly when behind the Cloudflare reverse proxy in full or flexible SSL mode. In addition, it ensures IP detection functions as expected when using Cloudflare in conjunction with a load balancer.
This works by registering the published Cloudflare address ranges as trusted proxies so the client IP address and HTTPS scheme are detected from the forwarded request headers.
Install the plugin with Composer.
composer require rainlab/cloudflare-plugin
No configuration is necessary, the plugin works out of the box.
Before using Cloudflare SSL, we recommend you remove any "http" to "https" redirects in your .htaccess file that you may have added. We find it safer to make this kind of redirection as a page rule in Cloudflare as this removes the risk that a misconfiguration or sudden change in proxy IPs might cause an infinite redirection loop.
To override the default configuration, create a file named config/rainlab/cloudflare/config.php in your project and return only the values you want to change.
<?php
return [
'ignore_frontend_scripts' => true,
];The following configuration values are supported.
| Key | Description | Default |
|---|---|---|
ignore_backend_scripts |
Adds data-cfasync="false" to script tags rendered in the backend area. |
true |
ignore_frontend_scripts |
Adds data-cfasync="false" to script tags rendered on the frontend. |
false |
trust_proxies |
Registers the Cloudflare network as trusted proxies. | true |
proxy_addresses |
The proxy address ranges to trust. | Cloudflare ranges |
The boolean values can also be set with environment variables.
CLOUDFLARE_IGNORE_BACKEND_SCRIPTS=true
CLOUDFLARE_IGNORE_FRONTEND_SCRIPTS=true
CLOUDFLARE_TRUST_PROXIES=true