Re: checking for and enforcing https

On Tue, 2008-02-26 at 09:45 -0500, Dan Joseph wrote: > On Tue, Feb 26, 2008 at 9:39 AM, tedd <tedd.sperling@gmail.com> wrote: > > > Sometimes I feel like a child here. > > > > Under what circumstances would one require that? > > > > If your script is in a https directory, isn't that secure? OR, is > > this something else? > > > > > > Well for instance. We have a web server here with http and https pointing > to the same place. then we have an admin login for the site and we want to > force people to go https even though they can do http to get there. So when > our users go to http://domain/admin/ it then redirects them to > https://domain/admin/. I do the same thing. For me I add an attribute to a page's pattern. Usually one of the following: 'https' => true, 'https' => false, 'https' => 'optional', Then a small bit of code checks the attribute and ensures the request meets the requirement. Cheers, Rob. -- .------------------------------------------------------------. | InterJinn Application Framework - http://www.interjinn.com | :------------------------------------------------------------: | An application and templating framework for PHP. Boasting | | a powerful, scalable system for accessing system services | | such as forms, properties, sessions, and caches. InterJinn | | also provides an extremely flexible architecture for | | creating re-usable components quickly and easily. | `------------------------------------------------------------'