kallithea Changeset - c394a564ab71

Changeset - c394a564ab71

Parent rev.

Child rev.

[Not reviewed]

beta

0 4 0

Marcin Kuzminski - 13 years ago 2013-02-10 20:35:35
marcin@python-works.com

make the htsts headers optional and stored in .ini file.
also don't use it with DEBUG

4 files changed with 16 insertions and 2 deletions:

development.ini

production.ini

rhodecode/config/deployment.ini_tmpl

rhodecode/lib/middleware/https_fixup.py

0 comments (0 inline, 0 general)

development.ini

➞

Show inline comments

@@ @@ -57,25 +57,28 @@ prefix = /<your-prefix> @@
 use = egg:rhodecode
 #filter-with = proxy-prefix
 full_stack = true
 static_files = true
 # Optional Languages
 # en, fr, ja, pt_BR, zh_CN, zh_TW, pl
 lang = en
 cache_dir = %(here)s/data
 index_dir = %(here)s/data/index
 app_instance_uuid = rc-develop
 cut_off_limit = 256000
 vcs_full_cache = True
 # force https in RhodeCode, fixes https redirects, assumes it's always https
 force_https = false
 # use Strict-Transport-Security headers
 use_htsts = false
 commit_parse_limit = 25
 # number of items displayed in lightweight dashboard before paginating
 dashboard_items = 100
 use_gravatar = true
 ## RSS feed options
 rss_cut_off_limit = 256000
 rss_items_per_page = 10
 rss_include_diff = false

production.ini

➞

Show inline comments

@@ @@ -57,25 +57,28 @@ prefix = /<your-prefix> @@
 use = egg:rhodecode
 #filter-with = proxy-prefix
 full_stack = true
 static_files = true
 # Optional Languages
 # en, fr, ja, pt_BR, zh_CN, zh_TW, pl
 lang = en
 cache_dir = %(here)s/data
 index_dir = %(here)s/data/index
 app_instance_uuid = rc-production
 cut_off_limit = 256000
 vcs_full_cache = True
 # force https in RhodeCode, fixes https redirects, assumes it's always https
 force_https = false
 # use Strict-Transport-Security headers
 use_htsts = false
 commit_parse_limit = 50
 # number of items displayed in lightweight dashboard before paginating
 dashboard_items = 100
 use_gravatar = true
 ## RSS feed options
 rss_cut_off_limit = 256000
 rss_items_per_page = 10
 rss_include_diff = false

rhodecode/config/deployment.ini_tmpl

➞

Show inline comments

@@ @@ -57,25 +57,28 @@ prefix = /<your-prefix> @@
 use = egg:rhodecode
 #filter-with = proxy-prefix
 full_stack = true
 static_files = true
 # Optional Languages
 # en, fr, ja, pt_BR, zh_CN, zh_TW, pl
 lang = en
 cache_dir = %(here)s/data
 index_dir = %(here)s/data/index
 app_instance_uuid = ${app_instance_uuid}
 cut_off_limit = 256000
 vcs_full_cache = True
 # force https in RhodeCode, fixes https redirects, assumes it's always https
 force_https = false
 # use Strict-Transport-Security headers
 use_htsts = false
 commit_parse_limit = 50
 # number of items displayed in lightweight dashboard before paginating
 dashboard_items = 100
 use_gravatar = true
 ## RSS feed options
 rss_cut_off_limit = 256000
 rss_items_per_page = 10
 rss_include_diff = false

rhodecode/lib/middleware/https_fixup.py

➞

Show inline comments

@@ @@ -26,30 +26,35 @@ @@
 from pylons.controllers.util import Request
 from rhodecode.lib.utils2 import str2bool
 class HttpsFixup(object):
     def __init__(self, app, config):
         self.application = app
         self.config = config
     def __call__(self, environ, start_response):
         self.__fixup(environ)
         req = Request(environ)
         debug = str2bool(self.config.get('debug'))
         if str2bool(self.config.get('use_htsts')) and not debug:
             req = Request(environ, self.application)
         resp = req.get_response(self.application)
         if environ['wsgi.url_scheme'] == 'https':
             resp.headers['Strict-Transport-Security'] = 'max-age=8640000; includeSubDomains'
                 resp.headers['Strict-Transport-Security'] = \
                     'max-age=8640000; includeSubDomains'
         return resp(environ, start_response)
         return self.application(environ, start_response)
     def __fixup(self, environ):
         """
         Function to fixup the environ as needed. In order to use this
         middleware you should set this header inside your
         proxy ie. nginx, apache etc.
         """
         # DETECT PROTOCOL !
         if 'HTTP_X_URL_SCHEME' in environ:
             proto = environ.get('HTTP_X_URL_SCHEME')
         elif 'HTTP_X_FORWARDED_SCHEME' in environ:
             proto = environ.get('HTTP_X_FORWARDED_SCHEME')
         elif 'HTTP_X_FORWARDED_PROTO' in environ:

0 comments (0 inline, 0 general)