[Zope] ssl zope http/https

[Ron Bickers]

On 12/02/2003 12:25 AM, Joshua Newman wrote:

> I've installed SSLAbsoluteURL but it seems to demand that I use links
> of a certain format: 

> A HREF="/Services/Support/Zope">Zope Support</A
> 
> but rather must use:
> 
> A HREF="<dtml-var "Services.Support.Zope" url>">Zope Support</A

> 1. Is my understanding correct?

It is.  SSLAbsoluteURL modifies the absolute_url method to detect an SSL
property and adjust the returned URL accordingly.  It does no magic with
"normal" URLs in HTML.

> 2. Is there another way to set the links (or better--the pages and
> folders) to be ssl besides the greatly appreciated but apparently 
> somewhat limited SSLAbsoluteURL format or manually changing each of the
> links? All of my links are in the format:
> 
> a href="/root/somewhere/index_html">foo</a 
> 
> and don't find https and I'd rather not change them all if I can help it.

I feel your pain. :-)  I'm still trying to figure out the best way to do
this since I (the author of SSLAbsoluteURL) don't particularly care for
having to munge my URLs either.  I've gone back to just spelling it out with
the full URL when I need to go to SSL or back.  I don't like that either,
but it works.

The problem is (or was at the time I wrote SSLAbsoluteURL) that the HTML is
not preprocessed by anything in Zope.  That is, there's nowhere to put a
program for handling an href attribute.  Although... hmmm... since Page
Template source is parsed, I'm wondering if there's some way to do this with
Page Templates.  I'll look into it eventually.

> 3. If I remove the 's' from 'https' after following one of my
> encrypted links I can still get the page unencrypted (i.e.http://...). Is
> there any way to stop this? It seems to defeat the purpose of
> encryption.

If you were using Apache SSL, you could handle this via Apache config, but I
don't know about m2crypto.

-- 
Ron Bickers
Logic Etc, Inc.