Mailing-List: contact user-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@couchdb.apache.org
Received-SPF: neutral (nike.apache.org: local policy)
MIME-Version: 1.0
In-Reply-To: 
 <CAJNb-9q2_RMeCK7hzvw=SMH_Sa6BPEU4HDyPAHkKUfBxBCaDag@mail.gmail.com>
References: 
 <CAFANTuUBC5Zzdv0cva3fOpM2i1_qZdiquSZ+r7fypd6SgceYDg@mail.gmail.com>
 <CABvT1DG-fGdFCjmk6MTn9kQ8Hrq=wVSv56VX=qyXKtK9ZdArsA@mail.gmail.com>
 <CAFANTuVc1hZ8XoBwDWZDcLxjOodPLO5jTuJ-KB_FheCRx=MSyA@mail.gmail.com>
 <CAJNb-9q2_RMeCK7hzvw=SMH_Sa6BPEU4HDyPAHkKUfBxBCaDag@mail.gmail.com>
From: Anthony Ananich <anton.ananich@inpun.com>
Date: Wed, 20 Mar 2013 16:21:56 +0300
Message-ID: 
 <CAFANTuWuE0gFgfn1TOqw_4FgXaAsVj0Uf1t-1i4JAmNSs09UCg@mail.gmail.com>
Subject: Re: _session + vhost + rewrites
To: user@couchdb.apache.org
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Good to know this. Thanks!

On Wed, Mar 20, 2013 at 3:50 PM, Benoit Chesneau <bchesneau@gmail.com> wrot=
e:
> On Wed, Mar 20, 2013 at 5:26 AM, Anthony Ananich
> <anton.ananich@inpun.com> wrote:
>> I think I've found an answer. It seems that while using vhost
>> /_session handler is available in the root of vhost independent on if
>> there are any rewrite rules or not.
>>
>> I was not able to find any documentation about that, so I'm not sure
>> if it is bug or feature :)
>
> It's a feature, see in the section [httpd] of default.ini:
>
> vhost_global_handlers =3D _utils, _uuids, _session, _oauth, _users
>
> - beno=EEt
>
>
>>
>> On Wed, Mar 20, 2013 at 3:18 PM, Robert Newson <rnewson@apache.org> wrot=
e:
>>> Hm, not without a code change, I think. The secure rewrites setting is
>>> to prevent a rewrite jumping between databases. At first glance it
>>> does seem an overreach to block a rewrite to _session (and presumably
>>> anything else at the top level).
>>>
>>> B.
>>>
>>> On 20 March 2013 12:13, Anthony Ananich <anton.ananich@inpun.com> wrote=
:
>>>> Hi!
>>>>
>>>> I'm trying to make _session handler accessible via url like
>>>> http://mysite.com/_session while using rewrite rules. I get the
>>>> following error:
>>>> {"error":"insecure_rewrite_rule","reason":"too many ../.. segments"}
>>>>
>>>> I found that it could be fixed with adding this to an ini file:
>>>> [httpd]
>>>> secure_rewrites =3D false
>>>>
>>>> Is there a way to allow _session without disabling secure_rewrites?
>>>>
>>>> Thanks,
>>>> Anthony