On Thursday 11 December 2003 18:26, Joachim Schmitz wrote:
> I want to allow access to the zope-managementinterface only over https
> is it possible with pound to redirect
>
> http://www.myzope.de/manage to https://www.myzope.de/manage ?
Pound does not redirect anything. What you can do is make sure that management
pages are not allowed over HTTP:
1. Start an instance of Pound. Include in the config:
ListenHTTP ...
UrlGroup ".*/manage"
# empty here
EndGroup
UrlGroup ".*"
# Your normal back-end defs here
EndGroup
2. Start a second instance of Pound:
ListenHTTPS ...
UrlGroup ".*"
# Your normal back-end defs here
EndGroup
This will ensure that anyone attempting to access an URL ending in /manage
over HTTP will be rejected.
Better solution: if this is Zope change the authorization code, which issues
the redirect required for authentication, to go to HTTPS.
Even better solution: wait for Pound 2.0 which will allow arbitrary redirects
(but don't hold your breath).
--
Robert Segall
Apsis GmbH
Postfach, Uetikon am See, CH-8707
Tel: +41-1-920 4904
|
