Repository navigation
when ENVIRONMENT=development is set, the server does not work on https #16
Description
There is an issue with the following bit of code:
/*/ Make sure HTTPS is always used in production /*/
$scheme = 'http';
if (getenv('ENVIRONMENT') !== 'development') {
$router->map('GET', '/{page:(?:.|/)*}', HttpToHttpsController::class)->setScheme($scheme);
$scheme = 'https';
}
I would expect https to work as well with the development environment, but because all the routes are tied to $scheme, they are only available on http.
Metadata
Metadata
Assignees
Labels
No labels
Type
Projects
- Status
Activity
Potherca commentedon Oct 7, 2020
That code was originally created to enable development before a (Docker) HTTPS server was available as the internal PHP HTTP server does (explicitly) not support HTTPS.
It might be more sensible to change the
getenv('ENVIRONMENT')check to something in the direction of "unsafe" rather than forcing all development environments to be unsafe...ylebre commentedon Oct 8, 2020
Maybe we can just check for env http or https to make it explicit? and even add routes for both schemes.
Potherca commentedon Oct 15, 2020
Strictly speaking, there shouldn't be any HTTP at all. It should just always redirect to HTTPS.
At this point, I'm inclined to just remove the HTTP code entirely...
ylebre commentedon Oct 17, 2020
I agree, having a secure default is the better option here, so we could just remove the http scheme completely. If someone really needs http:// it should be easy enough to modify that in the code.
Potherca commentedon Oct 23, 2020
We had a discussion offline, the current conclusion is as follows:
->setScheme($scheme)for evey route or route-group, we remove them everywhere. This makes the routes scheme-agnostic.This means that unsafe (i.e. HTTP) URLs are supported, in case HTTPS is provided through a server-side proxy.
The question that remains is whether it makes more sense to have the HTTPS check on or off.
Thoughts? @ylebre / @poef / @michielbdejong
Change ENVIRONMENT='development' to PROXY_MODE env variable for disab…
Change ENVIRONMENT='development' to PROXY_MODE env variable for disab…
Change ENVIRONMENT='development' to PROXY_MODE env variable for disab…