Thanks Steve, Yes, I have a redirect in there now similar to what wrote below. One problem with doing it this way is that if the user *does* manage to get to the page on the insecure port, the password they enter will be sent to the server unencrypted. Then the redirect takes over and everything else is done securely, which is better than nothing, but to me the password is important. In my experience, even well educated users will manage to find an application's "undocumented secrets" (bugs) :). Thanks for all your feedback. It's been very helpful. Eric. -----Original Message----- From: Steve Spicklemire [mailto:steve@spvi.com] Sent: Sunday, August 05, 2001 3:05 AM To: Eric Walstad Cc: Steve Spicklemire; zope@zope.org Subject: Re: [Zope] SSL + ProxyPass + Zope question... Hi Eric, Right... someone suggested a firewall.. which is fine if you want to make all of zope inaccessable on port 8080, and clearly it's a sure-fire solution. However it also requires that you have *access* to put up a firewall, which you might not! My thought was that, in Zope you could simply protect a particular area by adding code to standard_html_header in that area that did a check, e.g., <dtml-if "URL[:5] == 'http:'"> <dtml-call "RESPONSE.redirect('https:' + URL[5:])"> <dtml-return "'REDIRECTING.. to secure port.. '"> </dtml-if> ... This way, you could still use 8080 for other things if you wanted to. I guess the question comes down to 'who are you trying to protect from doing what?'. If it's your own users then, as Joachim mentioned maybe its just a matter of education? -steve On Saturday, August 4, 2001, at 11:48 PM, Eric Walstad wrote:
Hi Steve, Well, in the condition I described, if the user knows the port that Zope is running on, they could bypass Apache altogether. So, what I need is to make Zope inaccessible to the outside world. That way, all traffic would have to be sent thru Apache. Thanks, Eric.
-----Original Message----- From: Steve Spicklemire [mailto:steve@spvi.com] Sent: Friday, August 03, 2001 4:16 PM To: Eric Walstad Cc: Steve Spicklemire; zope@zope.org Subject: Re: [Zope] SSL + ProxyPass + Zope question...
Hi Eric,
Apache sets an environment variable when SSL is used. You can check for that varible in an Access rule, or standard_html_header or some other method.
-steve
On Friday, August 3, 2001, at 06:02 PM, Eric Walstad wrote:
Hello,
Apache is listening on port 80 and 443, Zope listening on port 8080. When a request comes in for port 443 (or HTTPS) Apache forwards the request to Zope on port 8080 and sends the results back out thru SSL, just as it should. If a user goes to https://mysite.com/PasswordProtectedArea/ an SSL connection is created and the password is forwarded to Zope after it's been sent thru SSL. However, if the user goes to http://mysite.com:8080/PasswordProtectedArea/ Apache never sees the request and it goes straight to Zope. The user is then prompted for a password, which would be sent back to Zope without SSL.
So my question is, how do I keep Zope from accepting any requests from the outside world unless they've gone thru Apache first? Can I tell Zope to listen on something like 192.168.1.123:8080 so that it will never see requests from the outside world?
TIA,
Eric.
_______________________________________________ Zope maillist - Zope@zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )