TYPO3 Core

If the config variable $TYPO3_CONF_VARS["BE"]["lockSSL"] is set to '3' (SSL only for login), it is impossible to reach BE.

Error message: Login-error or session timed-out / No user logged in! Sorry, I can't proceed then! / (You must have cookies enabled!)

In case of $TYPO3_CONF_VARS["BE"]["lockSSL"] = '1' or '2', everything is fine and I can reach full HTTPS backend without any problem, but SSL for whole BE is very resource-consuming, I would prefer it just for login.

HTTP HEADERS OF LOGIN PROCESS

(BE address without using SSL)

http://www.domain.com/typo3/index.php
GET /typo3/index.php HTTP/1.1
HTTP/1.x 302 Moved Temporarily
Location: https://www.domain.com/typo3/index.php

(redirect to SSL login page)

https://www.domain.com/typo3/index.php
GET /typo3/index.php HTTP/1.1
HTTP/1.x 200 OK
Set-Cookie: be_typo_user=XXXXX; path=/
(page with login form)

(HTTPS page after clicking "Log In" Button)

POST /typo3/index.php HTTP/1.1
Cookie: be_typo_user=XXXXX; fe_typo_user=YYYY;
Content-Length: 202
login_status=login&username=admin&p_field=&commandLI=Log+In&userident=ZZZ&challenge=AAA&redirect_url=backend.php&loginRefresh=&interface=backend

(HTTP page with error message)

HTTP/1.x 302 Found
Set-Cookie: be_typo_user=BBBB; path=/
Location: https://www.domain.com/typo3/backend.php

(issue imported from #M10401)