What to do with ssl="authenticated sessions" + code freeze date for Bugzilla 3.6

[David Miller]

Gregary Hendricks wrote on 8/19/09 5:46 PM:
> We also use a proxy that handles the SSL redirect. In our case urlbase
> is set to http and the proxy handles the SSL since we don't want to
> encrypt the data between the apache server and the proxy. Authentication
> in our system is also handled external to Bugzilla anyway so the reasons
> for using SSL are based on bug content. Since that is arbitrary, we
> enforce SSL always, but again, this is all handled external to Bugzilla.
> If we put https or set sslbase at all, we also see endless redirect
> loops.

Our proxy also handles the SSL with traffic between the proxy and
bugzilla unencrypted.  Bugzilla's apache is actually listening on ports
80 and 81 for cleartext and encrypted, and the port 81 vhost sets the
HTTPS environment variable so that mod_perl thinks it's SSL.

-- 
Dave Miller                                   http://www.justdave.net/
System Administrator, Mozilla Corporation      http://www.mozilla.com/
Project Leader, Bugzilla Bug Tracking System  http://www.bugzilla.org/