At the moment sslcookie => 0
never creates secure cookies, so if you log in
with SSL, your browser will send the session cookie even over plain HTTP.
Meanwhile sslcookie => 1
always creates secure cookies, so you can't
usefully log in over plain http.
This branch adds sslcookie => 0, sslcookie_auto => 1
as an option; this
uses the HTTPS
environment variable, so if you log in over SSL you'll
get a secure session cookie, but if you log in over HTTP, you won't.
(The syntax for the setup file is pretty rubbish - any other suggestions?)
Does this need to be a configurable option at all? The behavior could just be changed in the sslcookie = 0 case. It seems sorta reasonable that, once I've logged in via https, I need to re-login if I then switch to http.
Even better. I've amended the branch to have this behaviour, which turns it into a one-line patch. --smcv
And, if your change is made, the sslcookie option could probably itself be dropped too -- at least I don't see a real use case for it if ikiwiki is more paranoid about cookies by default.
I haven't done that; it might make sense to do so, but I think it'd be better to leave it in as a safety-catch (or in case someone's using a webserver that doesn't put
$HTTPS
in the environment). --sMight be best to fix want to avoid ikiwiki using http or https in urls to allow serving both first, so that dual https/http sites can better be set up. --Joey
Thanks for merging that! --s