redirect occurs after authorization !!!

am 27.10.2009 07:37:11 von joydeep

Hello list,

I have finally able to redirect the viewvc ( svn viewer ) to https. here
is the configuration

``````````````````````````````
ScriptAlias /test /usr/lib/cgi-bin/viewvc.cgi

RewriteEngine on
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

AuthType Basic
AuthName "requires a password"
AuthUserFile /home/svn/PASSWD
Require valid-user

```````````````````````````````````````````

This is working fine for both internet and intranet. But I have found
it first check the authorization through http connection and after
getting the right password it redirects to https version. Can I
redirect to http before authentication ?
Please let me know.
Thanks

------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: redirect occurs after authorization !!!

am 27.10.2009 10:45:46 von Krist van Besien

On Tue, Oct 27, 2009 at 7:37 AM, J. Bakshi wrote:
> Hello list,
>
> I have finally able to redirect the viewvc ( svn viewer ) to https. here
> is the configuration
>
> ``````````````````````````````
> ScriptAlias /test =A0/usr/lib/cgi-bin/viewvc.cgi
>
>
> RewriteEngine =A0 on
> RewriteCond %{HTTPS} off
> RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
>
> AuthType Basic
> AuthName "requires a password"
> AuthUserFile /home/svn/PASSWD
> Require valid-user
>
> ```````````````````````````````````````````
>
> This is working fine for both internet and intranet. =A0But =A0I have fou=
nd
> it first check the authorization through http connection and after
> getting the right password it redirects =A0to https version. =A0Can I
> redirect =A0to http before authentication =A0?

A couple of notes:

- Using to protect a resource on the local filesystem is a
absolutely bad idea. Your script might be accessible via another URL.
- Your rewrite rule does indeed do the correct redirection, but will
only do this after authentication. This because that is how you've
configured it. You've told your server to require authentication from
anyone accessing /test and this your server does. Authentication
happens very early in request processing, before rewriting.

A better way:

ScriptAlias /test /usr/lib/cgi-bin/viewvc.cgi

RewriteEngine on

RewriteCond %{HTTPS} off
RewriteRule /test.* https://%{HTTP_HOST}%{REQUEST_URI} [R]

SSLRequireSSL
AuthType Basic
AuthName "requires a password"
AuthUserFile /home/svn/PASSWD
Require valid-user

HTH,

Krist

--=20
krist.vanbesien@gmail.com
krist@vanbesien.org
Bremgarten b. Bern, Switzerland
--
A: It reverses the normal flow of conversation.
Q: What's wrong with top-posting?
A: Top-posting.
Q: What's the biggest scourge on plain text email discussions?

------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: redirect occurs after authorization !!!

am 27.10.2009 11:33:44 von joydeep

Krist van Besien wrote:
> On Tue, Oct 27, 2009 at 7:37 AM, J. Bakshi wrote:
>
>> Hello list,
>>
>> I have finally able to redirect the viewvc ( svn viewer ) to https. here
>> is the configuration
>>
>> ``````````````````````````````
>> ScriptAlias /test /usr/lib/cgi-bin/viewvc.cgi
>>
>>
>> RewriteEngine on
>> RewriteCond %{HTTPS} off
>> RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
>>
>> AuthType Basic
>> AuthName "requires a password"
>> AuthUserFile /home/svn/PASSWD
>> Require valid-user
>>
>> ```````````````````````````````````````````
>>
>> This is working fine for both internet and intranet. But I have found
>> it first check the authorization through http connection and after
>> getting the right password it redirects to https version. Can I
>> redirect to http before authentication ?
>>
>
> A couple of notes:
>
> - Using to protect a resource on the local filesystem is a
> absolutely bad idea. Your script might be accessible via another URL.
> - Your rewrite rule does indeed do the correct redirection, but will
> only do this after authentication. This because that is how you've
> configured it. You've told your server to require authentication from
> anyone accessing /test and this your server does. Authentication
> happens very early in request processing, before rewriting.
>
> A better way:
>
> ScriptAlias /test /usr/lib/cgi-bin/viewvc.cgi
>
> RewriteEngine on
>
> RewriteCond %{HTTPS} off
> RewriteRule /test.* https://%{HTTP_HOST}%{REQUEST_URI} [R]
>
>
>
> SSLRequireSSL
> AuthType Basic
> AuthName "requires a password"
> AuthUserFile /home/svn/PASSWD
> Require valid-user
>
>
>
> HTH,
>
> Krist
>
>

Hello Krist,

I must give you a words of thanks for showing me the right track. Also
grateful to you for your clarification. I have replaced my code with
yours. But the redirect is not working with this code. apache log reports

```````````````````````
access to /usr/lib/cgi-bin/viewvc.cgi failed, reason: SSL connection
required
```````````````````````````````````````

This is ok as redirection is not working here. Do you have any idea ? My
previous config with could did the redirection though.

Thanks

------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: redirect occurs after authorization !!!

am 27.10.2009 17:39:19 von Krist van Besien

On Tue, Oct 27, 2009 at 11:33 AM, J. Bakshi wrote=
:
> ```````````````````````
> =A0access to /usr/lib/cgi-bin/viewvc.cgi failed, reason: SSL connection
> required
> ```````````````````````````````````````
>
> This is ok as redirection is not working here. Do you have any idea ? My
> previous config with could did the redirection though.

Hmm. I'm not sure if aliases preempt rewriterules. Maybe that is the
problem. I asume everything works if you access directly over https?
ie, after entering https://test you are prompted for
authentication info, and then see viewvc?

Normally if you have set up your config the usual way you should have
two virtual hosts in your config, one for http, one for https. What
you could do is add the RewriteRule to the http vhost, and the rest to
the https vhost. That is how I would do it anyway.

Krist

--=20
krist.vanbesien@gmail.com
krist@vanbesien.org
Bremgarten b. Bern, Switzerland
--
A: It reverses the normal flow of conversation.
Q: What's wrong with top-posting?
A: Top-posting.
Q: What's the biggest scourge on plain text email discussions?

------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: redirect occurs after authorization !!!

am 27.10.2009 17:45:23 von Krist van Besien

Re: redirect occurs after authorization !!!

am 27.10.2009 18:42:52 von Tom Evans

On Tue, 2009-10-27 at 12:07 +0530, J. Bakshi wrote:
> Hello list,
>
> I have finally able to redirect the viewvc ( svn viewer ) to https. here
> is the configuration
>
> ``````````````````````````````
> ScriptAlias /test /usr/lib/cgi-bin/viewvc.cgi
>
>
> RewriteEngine on
> RewriteCond %{HTTPS} off
> RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
>
> AuthType Basic
> AuthName "requires a password"
> AuthUserFile /home/svn/PASSWD
> Require valid-user
>
> ```````````````````````````````````````````
>
> This is working fine for both internet and intranet. But I have found
> it first check the authorization through http connection and after
> getting the right password it redirects to https version. Can I
> redirect to http before authentication ?
> Please let me know.
> Thanks
>

I think I'm missing something. If you aren't supposed to access this
resource, except through SSL and after authentication, then surely this
is trivial.
Simply set up 2 vhosts, one SSL, one non-SSL. In the non-SSL vhost,
redirect to the SSL vhost and don't have any authentication. In the SSL
vhost, you can have your script and AAA setup.

Cheers

Tom

------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: redirect occurs after authorization !!!

am 28.10.2009 05:46:16 von joydeep

Tom Evans wrote:
> On Tue, 2009-10-27 at 12:07 +0530, J. Bakshi wrote:
>
>> Hello list,
>>
>> I have finally able to redirect the viewvc ( svn viewer ) to https. here
>> is the configuration
>>
>> ``````````````````````````````
>> ScriptAlias /test /usr/lib/cgi-bin/viewvc.cgi
>>
>>
>> RewriteEngine on
>> RewriteCond %{HTTPS} off
>> RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
>>
>> AuthType Basic
>> AuthName "requires a password"
>> AuthUserFile /home/svn/PASSWD
>> Require valid-user
>>
>> ```````````````````````````````````````````
>>
>> This is working fine for both internet and intranet. But I have found
>> it first check the authorization through http connection and after
>> getting the right password it redirects to https version. Can I
>> redirect to http before authentication ?
>> Please let me know.
>> Thanks
>>
>>
>
> I think I'm missing something. If you aren't supposed to access this
> resource, except through SSL and after authentication, then surely this
> is trivial.
> Simply set up 2 vhosts, one SSL, one non-SSL. In the non-SSL vhost,
> redirect to the SSL vhost and don't have any authentication. In the SSL
> vhost, you can have your script and AAA setup.
>
>

Hello Tom,

Thanks, yes it is another workaround.

cheers.

------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org