can we teach official Zope to start detecting "HTTPS" header?
I'm told that, here at Georgia Tech, we are running our Plone's Zope 2.10 behind "pound", and that we need some way to signal it about which requests are coming in through "http" and which came through "https", so that all of the links generated by Plone can start with the right protocol. So at the moment, users who type an "https" URL so that they can edit documents and enjoy some privacy immediately get kicked back to the "http" protocol the first time they click on a link. For an earlier version of our site, back on an earlier version of Zope and Plone, we edited Zope so that it detected an "HTTPS" header, if one was present, and allowed the value: HTTPS: on to change the protocol variable from HTTP to HTTPS. Then we told pound to provide that header when an "https" request was made, and to delete the header otherwise, and everything worked fine. Would there be any chance of getting this change into Zope trunk today, or is it too specific a need to be worth adding to the code just for us folks using "pound" at Georgia Tech? The patch, in the form in which we first wrote it back at the beginning of 2007, is attached for the curious. Thanks for any feedback! -- Brandon Craig Rhodes brandon@rhodesmill.org http://rhodesmill.org/brandon
The reason that that more folks probably don't complain about this is that they probably use Apache to do URL rewriting in conjunction with Zope's virtual host monster. And under that scenario, you indicate that you want Zope to generate https urls within the Apache rewrite rule as opposed to within a separate header. That said, it'd be fine to put this in, it would cause absolutely no harm. (Although I'm not volunteering, every time I try to check something in to the Zope repository these days, Philipp yells at me about style, so I'm getting gun-shy... ;-) ) - C Brandon Craig Rhodes wrote:
I'm told that, here at Georgia Tech, we are running our Plone's Zope 2.10 behind "pound", and that we need some way to signal it about which requests are coming in through "http" and which came through "https", so that all of the links generated by Plone can start with the right protocol. So at the moment, users who type an "https" URL so that they can edit documents and enjoy some privacy immediately get kicked back to the "http" protocol the first time they click on a link.
For an earlier version of our site, back on an earlier version of Zope and Plone, we edited Zope so that it detected an "HTTPS" header, if one was present, and allowed the value:
HTTPS: on
to change the protocol variable from HTTP to HTTPS. Then we told pound to provide that header when an "https" request was made, and to delete the header otherwise, and everything worked fine.
Would there be any chance of getting this change into Zope trunk today, or is it too specific a need to be worth adding to the code just for us folks using "pound" at Georgia Tech?
The patch, in the form in which we first wrote it back at the beginning of 2007, is attached for the curious. Thanks for any feedback!
------------------------------------------------------------------------
------------------------------------------------------------------------
_______________________________________________ Zope-Dev maillist - Zope-Dev@zope.org http://mail.zope.org/mailman/listinfo/zope-dev ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope )
Hi Chris
Betreff: Re: [Zope-dev] can we teach official Zope to start detecting "HTTPS"header?
[...]
(Although I'm not volunteering, every time I try to check something in to the Zope repository these days, Philipp yells at me about style, so I'm getting gun-shy... ;-) )
Philipp? Who's that ;-) I think another problem is that we do not understand what zope is or should be in the near future. Or at least not everybody drives in the same direction. This makes it very hard for optimization and do the right thing in the right place. We really need to clarify the direction of zope and it's zope.* packages in the near future. Then this whould allow us to do the optimization which is the next big step which I think is really needed. Regards Roger Ineichen
- C
participants (3)
-
Brandon Craig Rhodes -
Chris McDonough -
Roger Ineichen