TPS
/
ORIENT
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Make cms.backendForceSecure an explicit setting 

This no longer hinges on app.debug because it creates confusion for devops engineers. This is based on three independent reports coming from app environments that use a reverse proxy. The engineer will follow the proper security instructions by disabling debug mode, which in turn creates an infinite redirect loop when opening the back-end area, only to leave them scratching their heads

Ultimately it is the web server configuration's job to handle the enforcement of HTTPS, the app no longer enforces it as a strong opinion, but we still keep the setting available as a convenient security check for standard environments that do not use a reverse proxy
This commit is contained in:
Samuel Georges 2020-01-18 18:04:29 +11:00
parent 60ffd91064
commit e3b42b2f10
2 changed files with 4 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
config/cms.php
View File

@ -44,12 +44,12 @@ return [
|-------------------------------------------------------------------------- |--------------------------------------------------------------------------
| |
| Use this setting to force a secure protocol when accessing any back-end | Use this setting to force a secure protocol when accessing any back-end
| pages, including the authentication pages. If set to null, this setting | pages, including the authentication pages. This is usually handled by
| is enabled when debug mode (app.debug) is disabled. | web server config, but can be handled by the app for added security.
| |
*/ */
'backendForceSecure' => null, 'backendForceSecure' => false,
/* /*
|-------------------------------------------------------------------------- |--------------------------------------------------------------------------

7
modules/system/traits/SecurityController.php
View File

@ -82,11 +82,6 @@ trait SecurityController
return true; return true;
} }
$forceSecure = Config::get('cms.backendForceSecure', null); return !Config::get('cms.backendForceSecure', false);
if ($forceSecure === null) {
$forceSecure = !Config::get('app.debug', false);
}
return !$forceSecure;
} }
} }