[Date Prev][Date Next][Thread Prev][Thread Next][Interchange by date
][Interchange by thread
]
[ic] AlwaysSecure is not working
On Tue, Feb 26, 2002 at 01:18:27AM +0100, Joachim Leidinger wrote:
> Kyle Cook wrote:
> > Joachim,
> >
> > If you use area and page tags and set AlwaysSecure then the url is built to
> > be secure.
>
> Yes! Right!
>
> > To have IC "switch to secure" would require a redirect to the browser after the
> > browser requested an unsecure page.
> >
> > Technically it would be possible to redirect GET, but not possible to
> > redirect POST.
>
> It is the get methode! I simple type the url to the checkout page in to
> the url bar of my browser.
>
> > But there still remains the problem that the first call to an unsecure page
> > passes
> > all information insecurely before any redirect could be done.
>
> Why is IC checking the url, page and name for secure by AlwaysSecure in
> that page and not recognizing that the calling page itself is to be
> secure? What I mean is,
>
> AlwaysSecure a b c
>
> Page A has a link/url to b and c:
>
> Manual calling the page a in my browser is showing the page a *insecure*
> and the link/url in that page to the page b and c *is* secure.
>
> I'm wondering! IC is knowing, which page is calling and parse that page
> to check whether the another calling pages is set to be secure or not
> and is not able to recognize the calling page itselft is to be secure?
Yeah, I remember getting bitten by "AlwaysSecure" and concluding that
might not have been the best name for the option.
Why not write a little [usertag] to check path and permissions
as appropriate for your setup and to send redirect elsewhere
for failures?
--
Christopher F. Miller, Publisher cfm@maine.com
MaineStreet Communications, Inc 208 Portland Road, Gray, ME 04039
1.207.657.5078 http://www.maine.com/
Content/site management, online commerce, internet integration, Debian linux