Use the X-Forwarded-Proto header to set the scheme to https if needed

The "https" option in configuration file is deprecated and will be removed in 0.4

Changes

@@ -4,6 +4,8 @@ Revision history for LUTIm
 	- Antiflood protection for the "Download by URL" feature (#29)
 	- Stats page improved
 	- Remote port detection can now use the X-Remote-Port header if set
+	- LUTIm now uses the X-Forwarded-Proto header to set the scheme to https if needed
+	  The "https" option in configuration file is deprecated and will be removed in 0.4
 
 0.2  2014-03-07
 	- Server-side encryption available

README.md

@@ -66,7 +66,7 @@ vi lutim.conf
 * hosted\_by: if someone hosts your LUTIm instance, you can add some HTML (a logo for example) to make it appear on index page ;
 * tweet\_card\_via: a Twitter account which will appear on Twitter cards ;
 * max\_file\_size: well, this is explicit (default is 10Mio = 10485760 octets) ;
-* https: 1 if you want to provide secure images URLs (default is 0) ;
+* https: 1 if you want to provide secure images URLs (default is 0) DEPRECATED, PASS A `X-Forwarded-Proto` HEADER TO LUTIM FROM YOUR REVERSE PROXY INSTEAD ;
 * stats\_day\_num: when you generate statistics with `script/lutim cron stats`, you will have stats for the last `stats_day_num` days (default is 365) ;
 * keep\_ip\_during: when you delete IP addresses of image's senders with `script/lutim cron cleanbdd`, the IP addresses of images older than `keep_ip_during` days will be deleted (default is 365) ;
 * broadcast\_message: put some string (not HTML) here and this message will be displayed on all LUTIm pages (not in JSON responses) ;

lib/Lutim.pm

@@ -262,6 +262,11 @@ sub startup {
                     }
                 }
             }
+
+            # Scheme detection
+            if ((defined($c->req->headers->header('X-Forwarded-Proto')) && $c->req->headers->header('X-Forwarded-Proto') eq 'https') || (defined($c->config->{https}) && $c->config->{https})) {
+                $c->req->url->base->scheme('https');
+            }
         }
     );
 

lutim.conf.template

@@ -64,8 +64,9 @@
     # optional, no default
     #hosted_by         => 'My super hoster <img src="http://hoster.example.com" alt="Hoster logo">',
 
+    # DEPRECATED DEPRECATED DEPRECATED DEPRECATED DEPRECATED DEPRECATED DEPRECATED DEPRECATED DEPRECATED DEPRECATED
+    # LUTIm now checks if the X-Forwarded-Proto header is present and equal to https.
     # set to 1 if you use Lutim behind a secure web server
-    # secure connection detection will be improved in the future
     # optional, default is 0
     #https             => 0,
 

templates/about.html.ep

@@ -1,6 +1,5 @@
 % # vim:set sw=4 ts=4 sts=4 ft=html.epl expandtab:
-% my $scheme = (defined(config('https')) && config('https')) ? 'https' : 'http';
 <div class="modal-body">
-    <%==l 'informations-body', url_for('/')->base->scheme($scheme)->to_abs().'/', config('contact') %>
+    <%==l 'informations-body', url_for('/')->to_abs(), config('contact') %>
     <%= link_to url_for('index') => ( class => "btn btn-primary btn-lg" ) => begin %><%=l 'back-to-index' %><% end%>
 </div>

templates/index.html.ep

@@ -1,5 +1,4 @@
 % # vim:set sw=4 ts=4 sts=4 ft=html.epl expandtab:
-% my $scheme = (defined(config('https')) && config('https')) ? 'https' : 'http';
 <div class="messages">
 % if (config('always_encrypt')) {
     <p><%=l 'always_encrypt' %></p>
@@ -12,9 +11,9 @@
         <div>
             <strong><%= stash('filename') %></strong>
             <ul class="list-unstyled">
-                <li><i class="icon icon-eye" title="<%=l 'view-link' %>"></i> <%= link_to url_for('/')->base->scheme($scheme)->to_abs.'/'.stash('short') => begin %><%= url_for('/')->base->scheme($scheme)->to_abs.'/'.stash('short') %><%= end %></li>
-                <li><i class="icon icon-download" title="<%=l 'download-link' %>"></i> <%= link_to url_for('/')->base->scheme($scheme)->to_abs.'/'.stash('short').'?dl' => begin %><%= url_for('/')->base->scheme($scheme)->to_abs.'/'.stash('short').'?dl' %><%= end %></li>
-                <li><i class="icon icon-touiteur" title="<%=l 'twitter-link' %>"></i> <%= link_to url_for('/')->base->scheme($scheme)->to_abs.'/'.stash('short').'?t' => begin %><%= url_for('/')->base->scheme($scheme)->to_abs.'/'.stash('short').'?t' %><%= end %></li>
+                <li><i class="icon icon-eye" title="<%=l 'view-link' %>"></i> <%= link_to url_for('/')->to_abs().stash('short') => begin %><%= url_for('/')->to_abs().stash('short') %><%= end %></li>
+                <li><i class="icon icon-download" title="<%=l 'download-link' %>"></i> <%= link_to url_for('/')->to_abs().stash('short').'?dl' => begin %><%= url_for('/')->to_abs().stash('short').'?dl' %><%= end %></li>
+                <li><i class="icon icon-touiteur" title="<%=l 'twitter-link' %>"></i> <%= link_to url_for('/')->to_abs().stash('short').'?t' => begin %><%= url_for('/')->to_abs().stash('short').'?t' %><%= end %></li>
             </ul>
         </div>
     </div>
@@ -135,7 +134,7 @@
         if (dl !== '') {
             url = url+'?'+dl;
         }
-        return '<a href="<%== url_for('index')->base->scheme($scheme)->to_abs() %>/'+url+'"><%== url_for('index')->base->scheme($scheme)->to_abs() %>/'+url+'</a>';
+        return '<a href="<%== url_for('index')->to_abs() %>'+url+'"><%== url_for('index')->to_abs() %>'+url+'</a>';
     }
     function message(success, msg) {
         if(success) {

templates/layouts/default.html.ep

@@ -1,8 +1,7 @@
 % # vim:set sw=4 ts=4 sts=4 ft=html.epl expandtab:
 % use Mojo::Util qw(url_escape);
 % my $twitter_url = 'https://twitter.com/share';
-% my $scheme = (defined(config('https')) && config('https')) ? 'https' : 'http';
-% my $url    = url_for('/')->base->scheme($scheme)->to_abs().'/';
+% my $url    = url_for('/')->to_abs();
 % $twitter_url .= '?url='.url_escape("$url")
 %              .'&via=framasky'
 %              .'&text=Check out this %23LUTIm instance! ';
@@ -108,7 +107,7 @@
                             <h3 class="modal-title">LUTIm</h3>
                         </div>
                         <div class="modal-body">
-                            <%==l 'informations-body', url_for('/')->base->scheme($scheme)->to_abs().'/', config('contact') %>
+                            <%==l 'informations-body', url_for('/')->to_abs(), config('contact') %>
                         </div>
                         <div class="modal-footer">
                             <button type="button" class="btn btn-default" data-dismiss="modal">Close</button>

templates/twitter.html.ep

@@ -1,17 +1,16 @@
 % # vim:set sw=4 ts=4 sts=4 ft=html.epl expandtab:
-% my $scheme = (defined(config('https')) && config('https')) ? 'https' : 'http';
 <!DOCTYPE html>
 <html style="height:100%;">
     <head>
         <title>LUTIm</title>
         <meta name="viewport" content="width=device-width, initial-scale=1.0">
         <meta charset="utf-8" />
-        <link rel="icon" type="image/png" href="<%= url_for('/')->base->scheme($scheme) %>/img/favicon.png">
+        <link rel="icon" type="image/png" href="<%= url_for('/')->to_abs() %>img/favicon.png">
         <meta name="twitter:card" content="photo">
 % if (defined(config('tweet_card_via'))) {
         <meta name="twitter:site" content="<%= config('tweet_card_via') %>">
 % }
-        <meta name="twitter:image:src" content="<%= url_for('/')->base->scheme($scheme)->to_abs().'/'.$short %>">
+        <meta name="twitter:image:src" content="<%= url_for('/')->to_abs().$short %>">
     </head>
     <body style="height: 97%;">
         <img style="max-width:100%; max-height:100%;" src="<%= url_for('/').$short %>" alt="<%= $filename %>">