Subject: HTTPS environment variable is set after .htacces is parsed

From: [email-masked] (Domenico Andreoli)
Date: Sat, 1 Mar 2003 16:51:24 +0100

hi again,

with reference to debian bug report #103609 [1], a debian user states
that HTTPS environment variable is still not set during the parsinig
of .htacces.

i'm quoting the relevant part from that report.

------------- CUT HERE ---------------

This ought to work in .htaccess:

order deny,allow
deny from all
allow from 127.0.0.1
allow from env=HTTPS

...

I can see the HTTPS environment variable in the output if I call
a cgi script that dumps the environment, so it's there, it's just
that somehow at the time that .htaccess is parsed it isn't available
to 'allow from env=' statements yet.

------------- CUT HERE ---------------

i reproduced it with apache 1.3.27 and mod_ssl 2.8.12. so, if it is a
bug, is still present in most recent versions.

any comment?

cheers
cavok

[1] http://bugs.debian.org/103609

-----[ Domenico Andreoli, aka cavok
 --[ http://filibusta.crema.unimi.it/~cavok/gpgkey.asc
   ---[ 3A0F 2F80 F79C 678A 8936  4FEE 0677 9033 A20E BC50

---

From: Cliff Woolley <[email-masked]>
Date: Sat, 1 Mar 2003 11:02:22 -0500 (EST)

> allow from env=HTTPS

Why do you need that env var?  Use this instead:

order deny,allow
deny from all
allow from 127.0.0.1
SSLRequireSSL

--Cliff
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: [email-masked] (Domenico Andreoli)
Date: Sat, 1 Mar 2003 17:23:41 +0100

> Why do you need that env var?  Use this instead:
dunno, bug submitter used it. shouldn't it work anyway?

> SSLRequireSSL
i'll forward him your answer.

thanks
cavok

---

From: Cliff Woolley <[email-masked]>
Date: Sat, 1 Mar 2003 11:16:11 -0500 (EST)

> dunno, bug submitter used it. shouldn't it work anyway?

Environment variables are, as a rule, set late in the process because the
use of them has a relatively large performance penalty.  They're really
only there for communicating with CGI scripts and the like.

--Cliff

---

From: [email-masked] (Domenico Andreoli)
Date: Sat, 1 Mar 2003 17:31:44 +0100

> only there for communicating with CGI scripts and the like.
it sounds to me a clear explanation of the problem.

thanks again
domenico

---

From: [email-masked] (Domenico Andreoli)
Date: Mon, 10 Mar 2003 19:25:38 +0100

> Why do you need that env var?  Use this instead:

after some thinking at it, i see you answer is not suitable for my
needs. indeed, your mandates the use of SSL, while mine allowed access
from localhost *or* SSL.

i need something that can be put into allow directive...

thanks
cavok

---

From: Cliff Woolley <[email-masked]>
Date: Mon, 10 Mar 2003 14:49:50 -0500 (EST)

> needs. indeed, your mandates the use of SSL, while mine allowed access

Okay then, do this:

order deny,allow
deny from all
allow from 127.0.0.1
SSLRequireSSL
Satisfy any

--Cliff