a817acbbcc
The mechanism used for determining if the application is being served over SSL
is wrapped by the "express-session" library for "express_sid", and manual for
the "language" cookie, but it's very similar in both cases.
The "secure" flag is set if one of these is true:
1. we are directly serving Etherpad over SSL using the native nodejs
functionality, via the "ssl" options in settings.json
2. Etherpad is being served in plaintext by nodejs, but we are using a reverse
proxy for terminating the SSL for us;
In this case, the user has to be instructed to properly set trustProxy: true
in settings.json, and the information wheter the application is over SSL or
not will be extracted from the X-Forwarded-Proto HTTP header.
Please note that this will not be compatible with applications being served over
http and https at the same time.
The change on webaccess.js amends
|
||
|---|---|---|
| .. | ||
| api | ||
| assets | ||
| easysync | ||
| database.md | ||
| docker.md | ||
| documentation.md | ||
| index.md | ||
| localization.md | ||
| plugins.md | ||
| skins.md | ||
| stats.md | ||
| template.html | ||