summaryrefslogtreecommitdiff
path: root/doc/todo
diff options
context:
space:
mode:
authorhttp://smcv.pseudorandom.co.uk/ <smcv@web>2010-09-27 18:48:58 +0000
committerJoey Hess <joey@kitenet.net>2010-09-27 18:48:58 +0000
commite05099d5cf70b3637c57b6584df3bdfddbb5e513 (patch)
treeb646492736647341db1354f3a8b11f51b39c4e20 /doc/todo
parent06fe3dadae90c143eea80129e47d7dd1bc81282c (diff)
yay https
Diffstat (limited to 'doc/todo')
-rw-r--r--doc/todo/want_to_avoid_ikiwiki_using_http_or_https_in_urls_to_allow_serving_both.mdwn37
1 files changed, 33 insertions, 4 deletions
diff --git a/doc/todo/want_to_avoid_ikiwiki_using_http_or_https_in_urls_to_allow_serving_both.mdwn b/doc/todo/want_to_avoid_ikiwiki_using_http_or_https_in_urls_to_allow_serving_both.mdwn
index 1547c39eb..cbd8c4da7 100644
--- a/doc/todo/want_to_avoid_ikiwiki_using_http_or_https_in_urls_to_allow_serving_both.mdwn
+++ b/doc/todo/want_to_avoid_ikiwiki_using_http_or_https_in_urls_to_allow_serving_both.mdwn
@@ -88,16 +88,45 @@ you don't like my approach:
> both url and cgiurl to use `https://secure.foo.com/...` and rely on
> relative links to keep users of `http://insecure.foo.com/` on http until
> they need to use the cgi?
->
+
+>> My problem with that is that uses of the CGI aren't all equal (and that
+>> the CA model is broken). You could put CGI uses in two classes:
+>>
+>> - websetup and other "serious" things (for the sites I'm running, which
+>> aren't very wiki-like, editing pages is also in this class).
+>> I'd like to be able to let privileged users log in over
+>> https with httpauth (or possibly even a client certificate), and I don't
+>> mind teaching these few people how to do the necessary contortions to
+>> enable something like CACert.
+>>
+>> - Random users making limited use of the CGI: do=goto, do=404, and
+>> commenting with an OpenID. I don't think it's realistic to expect
+>> users to jump through all the CA hoops to get CACert installed for that,
+>> which leaves their browsers being actively obstructive, unless I either
+>> pay the CA tax (per subdomain) to get "real" certificates, or use plain
+>> http.
+>>
+>> On a more wiki-like wiki, the second group would include normal page edits.
+>>
+>> Perhaps I'm doing this backwards, and instead of having the master
+>> `url`/`cgiurl` be the HTTP version and providing tweakables to override
+>> these with HTTPS, I should be overriding particular uses to plain HTTP...
+>>
+>> --[[smcv]]
+
> I'm unconvinced.
>
> `Ikiwiki::baseurl()."foo"` just seems to be asking for trouble,
> ie being accidentially written as `IkiWiki::baseurl("foo")`,
> which will fail when foo is not a page, but some file.
->
+
+>> That's a good point. --s
+
> I see multiple places (inline.pm, meta.pm, poll.pm, recentchanges.pm)
> where it will now put the https url into a static page if the build
> happens to be done by the cgi accessed via https, but not otherwise.
> I would rather not have to audit for such problems going forward.
->
-> --[[Joey]]
+
+>> Yes, that's a problem with this approach (either way round). Perhaps
+>> making it easier to run two mostly-synched copies like I was previously
+>> doing is the only solution... --s