Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Date: Tue, 20 Jul 2004 17:09:52 +0100
From: Colm MacCarthaigh <colm@stdlib.net>
To: Manni Wood <mwood@digitas.com>
Cc: dev@httpd.apache.org
Subject: Re: Invitation to HTTPD commiters in tomcat-dev
Message-ID: <20040720160952.GA605@castlerea.stdlib.net.>
Reply-To: colm@stdlib.net
References: <30C025BBA30D3343935890628BCCEA32AEDD9B@BOSEXVS2.digitas.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-15
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <30C025BBA30D3343935890628BCCEA32AEDD9B@BOSEXVS2.digitas.com>
User-Agent: Mutt/1.3.28i

On Tue, Jul 20, 2004 at 12:08:01PM -0400, Manni Wood wrote:
> Along with the ability for your back-end servlets to get a correct
> value from ServletRequest.isSecure() depending on whether or not
> Apache was originally contacted with HTTP vs HTTPS?

Personally, I always use Apache to authenticate such things directly
before allowing anything to execute. By allowing the script to
authenticate it, the thing is already running and I'm already prone to
whatever some scripter's idea of secure programming is - so there's
hardly a point.

It's much simpler to just not proxy if the originating request wasn't
SSL. But if it's really neccessary that it be conditional, use an X- header, 
or a query string :-)

-- 
Colm MacC�rthaigh                        Public Key: colm+pgp@stdlib.net