From: https://www.google.com/accounts/o8/id?id=AItOawk8U772S3jDrZJCO0WA5WaDLjJv5mMl6Yw Date: Tue, 14 Oct 2014 13:46:55 +0000 (-0400) Subject: (no commit message) X-Git-Url: https://sipb.mit.edu/gitweb.cgi/ikiwiki.git/commitdiff_plain/194c0a1084f442f220226fe46fef07e9282b80b5 --- diff --git a/doc/forum/HTTPS_edit_required_no_authentication.mdwn b/doc/forum/HTTPS_edit_required_no_authentication.mdwn new file mode 100644 index 000000000..033033f49 --- /dev/null +++ b/doc/forum/HTTPS_edit_required_no_authentication.mdwn @@ -0,0 +1,9 @@ +Hello, + +I've already [[sent a bug|/bugs/HTTPS_edit_required_no_authentication/]] but I think that discussion can also help... + +I've setup authentication on my ikiwiki website using httpauth plugin. I've also disabled anonok, openid and passwordauth so that httpauth is the unique authentication method. I've configured the `cgiauthurl` to https://example.com/auth/ikiwiki.cgi in order to make the authentication more secured (password is never sent in clear). My `url` points to http://example.com/ and my `cgiurl` points to http://example.com/ikiwiki.cgi . + +When I try to edit a page accessed by http, everything works fine: there is a redirection to https://example.com/auth/ikiwiki.cgi (defined in `cgiauthurl`) and my browser launches an HTTP Basic Authentication login form. But when I try to edit a page accessed by https there is no redirection to the `cgiauthurl` url. Instead, I can edit (and save) the page without authentication. I've tried this with a fresh new browser session where I have never been asked for authentication before. It seems that editing pages directly from https://example.com/ikiwiki.cgi?page=page&do=edit works without authentication... + +I think that the Ikiwiki CGI do not redirect to `cgiauthurl` when it is accessed by HTTPS.