Re: How to force response to ONLY https requests...

At 10:53 -0500 17-12-03, Jay Riopelle wrote:
>Hi all:
>
>I have a Mac OS X Server set up with SSL, and a 
>deployed WO application - connecting through 
>"https://..."
>works ok and transactions are secure, but the 
>server is also responding to requests through 
>"http://...".  I have
>seen postings describing how to set the response 
>from the WO app to always be "https", which is 
>fine, but I
>would ideally like it if the app ONLY responded to https requests. 
>
>It seems like a bit of a security hole if there 
>is a possibility that a non-secure request can 
>be made (I want to
>have secure data flow both ways, request and 
>response, for stuff like login name and 
>password, etc.).  I  would
>prefer to have the app only respond to secure requests. 
>
>Anyone know how to make that happen (other than 
>by blocking port 80)?  I've tried setting 
>-WOCGIAdaptorURL
>argument to "https://...", but that doesn't do it.
>



Hi!

If you want to do this in your application you 
can use one of the methods bellow:


Chuck Hill <[email protected]> posted this method some time ago:

static public boolean isHTTPSRequest(WORequest request)
{
     boolean isHTTPSRequest = false;

     // Depending on the adaptor the incoming port can be found in one of two
     // places.
     String serverPort = request.headerForKey("SERVER_PORT");
     if (serverPort == null)
     {
         serverPort = request.headerForKey("x-webobjects-server-port");
     }

     // Apache and some other web servers use this to indicate HTTPS mode.
     String httpsMode = request.headerForKey("https");

     // If either the https header is 'on' or the server port is 443 then we
     // consider this to be an HTTP request.
     isHTTPSRequest = ( ((httpsMode != null) &&
                          httpsMode.equalsIgnoreCase("on")) ||
                        ((serverPort != null) && serverPort.equals("443")) );

         return isHTTPSRequest;
     }

}


...and Jonathan 'Wolf' Rentzsch <[email protected]> posted this one:


private boolean ShowSecurePage( WOResponse response, WOContext context ) {
   // <snip>

   // Is this page being accessed securely?
   boolean secureMode = false;
   String header = context.request().headerForKey("https");
   if( header == null ) {
     log.debug( "no https header, looking for server_port" );
     header = context.request().headerForKey( "server_port" );
     if( header == null ) {
       log.debug( "no server_port header found, assuming insecure
connection" );
     } else {
       log.debug( "server_port header found, using it" );
       secureMode = header.equals( "443" );
     }
   } else {
     log.debug( "https header found, using it" );
     secureMode = header.equals( "on" );
   }
   log.debug( "secure mode set to " + secureMode );

   // <snip>
}


...and Jürgen Rohrbach <[email protected]> posted this one:


public static String serverPort(WORequest request) {
    String value = request.headerForKey("SERVER_PORT");
    if (value != null) return value;
    return request.headerForKey("x-webobjects-server-port");
}

public static boolean isRequestSecure(WORequest request) {
    return "443".equals(serverPort(request));
}



-Kaj :)