[pmwiki-users] SSL setup

[H. Fox]

On 4/21/06, Joachim Durchholz <jo at durchholz.org> wrote:
> You could try
>
>    $ScriptUrl = '/wiki/pmwiki.php';
>    $PubDirUrl = '/wiki/pub';
>
> so that the browsers auto-complete the protocol and host name part of
> the URL (I think they should).

For the sake of producing links, yes.  For the sake of delivering a
page, I'm not so sure.

> That way, you are not sold to the https vs. http decision.
>
> > Try putting this in your .htaccess file:
> >
> >   SSLRequireSSL
> >
> > http://www.apache-ssl.org/docs.html#SSLRequireSSL
>
> Not needed if URLs like the above are used.

Really?  How does that stop someone from requesting a page via HTTP?

IOW, the above will affect links PmWiki creates, but how does it stop
requesting a specific PmWiki page from port 80?  I don't think it does
on a server that's listening on both ports.

> SSLRequireSSL will generate just a nasty error message in case of people
> accessing the page without SSL. A redirect (preferably permanent) would
> be more appropriate.

If you are using a redirect, then SSLRequireSSL doesn't hurt.  It
keeps information from accidentally slipping out via HTTP.  I think
that's the point the documentation is making with "This is a useful
belt-and-braces measure for critical information."

Hagan