Support require-secure with remote SSL terminators#172
Open
jessekempf wants to merge 1 commit intosnoyberg:masterfrom
Open
Support require-secure with remote SSL terminators#172jessekempf wants to merge 1 commit intosnoyberg:masterfrom
jessekempf wants to merge 1 commit intosnoyberg:masterfrom
Conversation
Previously require-secure would cause a redirect loop if run on an app server behind an SSL-terminating reverse proxy, like an Amazon ELB. That's because it ignored X-FORWARDED-PROTO and other headers and just checked whether keter was being talked to over an encrypted socket. This change uses WAI's "was this request made over a secure connection?" logic as a supplement to the old way.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Previously require-secure would cause a redirect loop if run on an
app server behind an SSL-terminating reverse proxy, like an Amazon
ELB. That's because it ignored X-FORWARDED-PROTO and other headers
and just checked whether keter was being talked to over an encrypted
socket. This change uses WAI's "was this request made over a secure
connection?" logic as a supplement to the old way.