search

codeforamerica / cfapi

The Code for America API. Tracks and motivates activity and participation across the civic technology movement.
http://codeforamerica.org/api
MIT License
113 stars 52 forks source link

Fix api_base URL scheme to detect SSL #189

Open migurski opened 9 years ago

migurski commented 9 years ago

URLs in the API docs say http:// even on an SSL page. We’ll need to revisit the use of request.scheme in app.py so it correctly picks up the new schema for display, even when proxied behind Apache.

Context in https://github.com/codeforamerica/codeforamerica.org/issues/529#issuecomment-72798885.

ondrae commented 9 years ago

@tmaybe and I have been tracing this out.

There is a clue at http://stackoverflow.com/a/24920818/722860 about making an addition to Apache. @migurski What say you?

tmaybe commented 9 years ago

here are the current headers we're getting on an https request (I removed Cookie and User-Agent):

X-Forwarded-Port: 80
X-Forwarded-For: 69.12.169.82, 54.234.33.69
Pragma: no-cache
X-Request-Id: cc29f5ca-f65c-43f6-882b-f9654450ba47
X-Request-Start: 1423091731285
X-Forwarded-Proto: http
X-Forwarded-Server: codeforamerica.org
Cache-Control: no-cache
Accept-Language: en-US,en;q=0.8,id;q=0.6
Host: www.codeforamerica.org
Accept-Encoding: gzip, deflate, sdch
Via: 1.1 vegur
Total-Route-Time: 0
Connect-Time: 0
Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Gecko) Chrome/40.0.2214.91 Safari/537.36
tmaybe commented 9 years ago

See also: http://flask.pocoo.org/snippets/35/

migurski commented 9 years ago

I can definitely add a new request header to the main proxy config. Want to put our heads together on this tomorrow?

tmaybe commented 9 years ago

yeah! let's do it