Commits on Aug 1, 2017

1. perfer X-Forwarded-Proto to prevent users lying …

   X-Forwarded-Proto should be the preferred header to used to check if the
   front end connection was HTTPS.  Proto is the de facto standard for
   this, and is recommended in the deployment documentation.
   
   If the -Protocol header is checked first, that means most setups that
   only add a -Proto header will pass through a user provided -Protocol
   header, allowing users to lie about the protocol used.
   
   Ideally this would only check one header, and the reverse proxy would be
   required to send that header.  Leaving this with the fallback behavior
   for now for backwards compatibility.

   

   haarg committed Aug 1, 2017
   Configuration menu

   • View commit details
   • Copy full SHA for 03d89b4
   • Browse repository at this point

   Copy the full SHA

   03d89b4 View commit details

   Browse the repository at this point in the history