Mailing-List: contact users-help@subversion.apache.org; run by ezmlm
Precedence: bulk
From: "Bert Huijben" <bert@qqmail.nl>
To: =?UTF-8?Q?'Thorsten_Sch=C3=B6ning'?= <tschoening@am-soft.de>,
	<users@subversion.apache.org>
References: <837120456.20150819215024@am-soft.de>
In-Reply-To: <837120456.20150819215024@am-soft.de>
Subject: RE: Is it safe to redirect from HTTP to HTTPS in case of
 svn:externals?
Date: Wed, 19 Aug 2015 22:06:47 +0200
Message-ID: <015401d0daba$94f96950$beec3bf0$@qqmail.nl>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Thread-Index: AQIf8Hw22F0FbRj6uiRddRE+cuhdT511k0/Q
Content-Language: nl


> -----Original Message-----
> From: Thorsten Sch=C3=B6ning [mailto:tschoening@am-soft.de]
> Sent: woensdag 19 augustus 2015 21:50
> To: users@subversion.apache.org
> Subject: Is it safe to redirect from HTTP to HTTPS in case of =
svn:externals?
>=20
> Hi,
>=20
> I'm implementing publicly accessible mod_davn_svn in addition to some
> internally used svnserve. Some of my repos use svn:externals where we
> used to defined "//internal.example.org/...", my publicly available
> entry point is "https://external.example.org". For the public
> "internal.example.org" is resolved as "external.example.org", so
> checking out a repo from HTTPS with svn:externals used would result in
> a request to "https://internal.example.org" and produce certificate
> verification failures in the client because of mismatching domain
> names and such.
>=20
> So I thought of simply changing the svn:externals definition to
> "http://internal.example.org" which I can then redirect to
> "https://external.example.org" on my public server. In my tests that
> seemed to work properly and the important part is that the locally
> created working copy for svn:externals only contained HTTPS-URLs.
>=20
> So am I correct that my approach is safe regarding that no user
> passwords or such are going unencrypted over the wire if only the
> first request doesn't contain such passwords and will always only be
> the redirect? Any other problems which I might overlook currently?

The key Subversion uses to store passwords is different between http and =
https, so a password used for https won't be used for http.

There are other options to specify your externals; see 'svn help =
propset'
[[
      The URL may be a full URL or a relative URL starting with one of:
        ../  to the parent directory of the extracted external
        ^/   to the repository root
        /    to the server root
        //   to the URL scheme
      ^/../  to a sibling repository beneath the same SVNParentPath =
location
]]


	Bert