4 ms·
If the language spec says that $_SERVER['HTTPS'] is an indicator of whether the request was made over HTTPS, then it should ensure that it adheres to its own sp
by Cakez0r 11y ago
If the language spec says that $_SERVER['HTTPS'] is an indicator of whether the request was made over HTTPS, then it should ensure that it adheres to its own spec (I.E. not overwrite $_SERVER['HTTPS'] with the value from a header, if it's present).
- nolok 11y agoIt does. The problem is in Apache, not the language. Apache's says to look into the HTTPS variable (that it adds itself before passing the call to the handler) to know if the call was made over https, but then it overwrite that variable with the browser-sent header if there is one (or more exactly, it uses the same variable name for that header and it's own HTTPS indicator; so it overwrites if both are present, and if only the header is present then it creates it when it shouldn't -- the issue in this post).