Re^3: PSGI, Plack et.al.

[McA]

in reply to Re^2: PSGI, Plack et.al.
in thread PSGI, Plack et.al.

Hi,

but you should not forget that there are circumstances where you want to know whether requests came via https or http. Just two examples:

• You want to generate absolute URL in the response to reflect the currently used protocol.
• You want to set the secure attribute on cookies when you know that the response is sent via https.

Best regards
McA

[Corion]

A common? trick to avoid the protocol is a schemaless URL:

# Instead of
https://example.com/foo/bar
# use
//example.com/foo/bar

This will use the same protocol as the origin.

[Anonymous Monk]

Q: How to detect reverse proxy and SSL frontend · plack/Plack Wiki · GitHub

A: use Plack::Middleware::ReverseProxy

[afoken]

there are circumstances where you want to know whether requests came via https or http

At least the Apache webserver sets up several CGI environment variables, the most obvious one is HTTPS set to on. It also adds a ton of environment variables starting with SSL_ describing many aspects of the SSL connection. The CGI 1.1 RFC 3875 leaves HTTPS unspecified, but allows the Apache behaviour.

Alexander