Mailing-List: contact user-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@couchdb.apache.org
Received-SPF: pass (athena.apache.org: local policy)
From: Jeff Charette <iomatix@yahoo.com>
Content-Type: multipart/alternative;
 boundary="Apple-Mail=_C2FC4877-665E-4C38-969F-058E867A1049"
Message-Id: <EE7B3BBE-0F31-4BF4-881B-55DF72CE8F0D@yahoo.com>
Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\))
Subject: Re: _session + vhost + rewrites
Date: Wed, 20 Mar 2013 20:09:47 -0400
References: 
 <CAFANTuUBC5Zzdv0cva3fOpM2i1_qZdiquSZ+r7fypd6SgceYDg@mail.gmail.com>
 <CABvT1DG-fGdFCjmk6MTn9kQ8Hrq=wVSv56VX=qyXKtK9ZdArsA@mail.gmail.com>
 <CAFANTuVc1hZ8XoBwDWZDcLxjOodPLO5jTuJ-KB_FheCRx=MSyA@mail.gmail.com>
 <CAJNb-9q2_RMeCK7hzvw=SMH_Sa6BPEU4HDyPAHkKUfBxBCaDag@mail.gmail.com>
 <CAFANTuWuE0gFgfn1TOqw_4FgXaAsVj0Uf1t-1i4JAmNSs09UCg@mail.gmail.com>
To: user@couchdb.apache.org
In-Reply-To: 
 <CAFANTuWuE0gFgfn1TOqw_4FgXaAsVj0Uf1t-1i4JAmNSs09UCg@mail.gmail.com>

--Apple-Mail=_C2FC4877-665E-4C38-969F-058E867A1049
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=iso-8859-1

+1

Jeff Charette | Principal=20
We Are Charette
web / identity / packaging

m  415.298.2707
w  wearecharette.com
e   jeffrey@wearecharette.com

On Mar 20, 2013, at 9:21 AM, Anthony Ananich <anton.ananich@inpun.com> =
wrote:

> Good to know this. Thanks!
>=20
> On Wed, Mar 20, 2013 at 3:50 PM, Benoit Chesneau <bchesneau@gmail.com> =
wrote:
>> On Wed, Mar 20, 2013 at 5:26 AM, Anthony Ananich
>> <anton.ananich@inpun.com> wrote:
>>> I think I've found an answer. It seems that while using vhost
>>> /_session handler is available in the root of vhost independent on =
if
>>> there are any rewrite rules or not.
>>>=20
>>> I was not able to find any documentation about that, so I'm not sure
>>> if it is bug or feature :)
>>=20
>> It's a feature, see in the section [httpd] of default.ini:
>>=20
>> vhost_global_handlers =3D _utils, _uuids, _session, _oauth, _users
>>=20
>> - beno=EEt
>>=20
>>=20
>>>=20
>>> On Wed, Mar 20, 2013 at 3:18 PM, Robert Newson <rnewson@apache.org> =
wrote:
>>>> Hm, not without a code change, I think. The secure rewrites setting =
is
>>>> to prevent a rewrite jumping between databases. At first glance it
>>>> does seem an overreach to block a rewrite to _session (and =
presumably
>>>> anything else at the top level).
>>>>=20
>>>> B.
>>>>=20
>>>> On 20 March 2013 12:13, Anthony Ananich <anton.ananich@inpun.com> =
wrote:
>>>>> Hi!
>>>>>=20
>>>>> I'm trying to make _session handler accessible via url like
>>>>> http://mysite.com/_session while using rewrite rules. I get the
>>>>> following error:
>>>>> {"error":"insecure_rewrite_rule","reason":"too many ../.. =
segments"}
>>>>>=20
>>>>> I found that it could be fixed with adding this to an ini file:
>>>>> [httpd]
>>>>> secure_rewrites =3D false
>>>>>=20
>>>>> Is there a way to allow _session without disabling =
secure_rewrites?
>>>>>=20
>>>>> Thanks,
>>>>> Anthony


--Apple-Mail=_C2FC4877-665E-4C38-969F-058E867A1049--