Gustav,
I let Pound add an extra X header when the client has a HTTPS
connection to Pound. X-SSL-Request is set to true to indicate that
the connection to the browser is secure.
The request processor and the security procs of OpenACS then
treat the connection as if directly connection over HTTPS to
AOLserver. Or in a schema:
HTTPS -> Pound -> HTTP + X-SSL-Request: true -> AOLserver
is treated the same as:
HTTPS -> AOLserver
For now the mods to OpenACS don't verify that the IP address of
the request coming from Pound is indeed originating from a trusted
proxy. A hacker knowing the (internal) IP address of the proxy
could potentially spoof a secure connection. Cross-referencing the
IP address against a (list of) trusted IP address(es), however, is
trivial to add.
Did you know that AOLserver 4.x automatically records the
X-Forwarded-For IP address?
Bart
the Code Mill
