Optionally force https:// protocol when logged in

[Martijn Pieters <mj@…>]

I like to protect my login credentials with encrypted links, but also like to keep trac accessible to casual visitors ("self-signed certificates are scary"). To achieve this I set up both http and https access to trac; the http://(.*)/login link redirects to https://$1/login (which does the usual Apache auth) and the https://(.*)/logout link goes back to http://$1/logout. This works fine up to the moment an http:// link is encountered leading back to the unencrypted urls (or the url has been altered manually). I solved this by adding a conditional rewrite rule that redirects to the https version if a trac_auth cookie is encountered (see also #1773).

I'd like trac to take care of this instead if so configured. The login and logout links then link to the ​https:// and ​http:// links respectively. All other links must use the ​https:// protocol when logged in; trac should use the old behavior (using the supplied request information for the protocol) when not logged in.

[sid]

This appears to be an Apache problem rather than a Trac problem.

[Noah Kantrowitz (coderanger) <coderanger@…>]

The SecSession plugin on trac-hacks will do this.

[sid]

In that case, this does not seem like a general enough problem that it will be a part of Trac core. Propose closing as wontfix and point to the plugin if the functionality is desired.

[Christian Boos]

See ​TH:SecSessionPlugin.