)]}'
{"nova/wsgi.py":[{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"e0fc49656cd1af78431c72031446f6535c3cec4f","unresolved":false,"context_lines":[{"line_number":55,"context_line":"               help\u003d\u0027The HTTP header used to determine the scheme for the \u0027"},{"line_number":56,"context_line":"                    \u0027original request, even if it was removed by an SSL \u0027"},{"line_number":57,"context_line":"                    \u0027terminating proxy. Typical value is \u0027"},{"line_number":58,"context_line":"                    \u0027\"HTTP_X_FORWARDED_PROTO\".\u0027),"},{"line_number":59,"context_line":"    cfg.StrOpt(\u0027ssl_ca_file\u0027,"},{"line_number":60,"context_line":"               help\u003d\"CA certificate file to use to verify \""},{"line_number":61,"context_line":"                    \"connecting clients\"),"}],"source_content_type":"text/x-python","patch_set":2,"id":"1a4dcd0f_72eb10b1","line":58,"updated":"2015-08-05 09:48:48.000000000","message":"I\u0027m not convinced this really ought to be a config parameter. It seems to me that if we see HTTP_X_FORWARDED_PROTO set, we should just unconditionally use that, not need a manually set config parameter which effectively amounts to \"make_ssl_work_right\u003dTrue|False\". We should just do the right thing out of the box IMHO.","commit_id":"ab35779238658ad8595e383618ca28a191c1085d"},{"author":{"_account_id":8648,"name":"Radomir Dopieralski","email":"openstack@dopieralski.pl","username":"thesheep"},"change_message_id":"dbf67d4f7798ac5c268e93a903da50ddeb5437d4","unresolved":false,"context_lines":[{"line_number":55,"context_line":"               help\u003d\u0027The HTTP header used to determine the scheme for the \u0027"},{"line_number":56,"context_line":"                    \u0027original request, even if it was removed by an SSL \u0027"},{"line_number":57,"context_line":"                    \u0027terminating proxy. Typical value is \u0027"},{"line_number":58,"context_line":"                    \u0027\"HTTP_X_FORWARDED_PROTO\".\u0027),"},{"line_number":59,"context_line":"    cfg.StrOpt(\u0027ssl_ca_file\u0027,"},{"line_number":60,"context_line":"               help\u003d\"CA certificate file to use to verify \""},{"line_number":61,"context_line":"                    \"connecting clients\"),"}],"source_content_type":"text/x-python","patch_set":2,"id":"1a4dcd0f_68a22a4d","line":58,"in_reply_to":"1a4dcd0f_72eb10b1","updated":"2015-08-05 16:29:08.000000000","message":"This is a common pattern, and it\u0027s done this way, because when the service is not behind a proxy, and this header is not being rewritten, the user or anything on the way can set it and potentially make your application redirect users to a wrong address, which in turn can lead to some javascript attacks.\n\nIn other words, making this enabled by default would be a security risk. You only want to set it to a header that you actually control in your proxy.","commit_id":"ab35779238658ad8595e383618ca28a191c1085d"}]}