[TYPO3-dev] Scheme enforcement in 4.5.x

[Felix Nagel]

Am 07.12.2011 11:43, schrieb Ernesto Baschny [cron IT]:
> Hi Felix,
>
> you don't need to enforce anything on link generation time. You enforce
> a redirect on the landing page: Once you hit the landing page, it will
> redirect you to the HTTP or HTTPS variant, whichever is configured. This
> is how https_enforcer and the new feature in TYPO3 4.5 works. Only that
> the new feature of 4.5 lacks a way of telling which is the "default"
> scheme for pages where nothing has been declared (leaving the protocol
> untouched).
Right. I dont like to use https_enforcer as TYPO3 4.5 (should) have 
scheme support built in and the extension has a lot overhead.

> Once we have a way to specify the default value (new feature, candidate
> for backporting to 4.5 in my eyes), you can set that to "http" and
> wherever you are in HTTPS mode, and click on a link, the first browser
> will call that page with HTTPS and then switch (redirect) to HTTP
> (because that's the default).
There is no such feature in TYPO3 4.6 isnt it? Im a little confused 
because you wrote backporting.

> No need to try to parse typoscript settings from remote trees where you
> are linking to. The destination page should know what to do. This also
> handles the case when external links points to a page which is supposed
> to be HTTPS (and user is going to it with HTTP): the magic redirects the
> user to the correct protocol.

So you would like to extend the redirect functionality within function 
fetch_the_id (class.tslib_fe.php) instead of my approach (typoLink 
function in class.tslib_content.php), right?

I assume this would be working, but I was not able to get a TS config in 
that function (via somehting like 
$GLOBALS['TSFE']->config['config']['urlScheme']) -- some Core Dev tips 
here? ;-)

I must confess I dont like the idea of generating "incorrect" links and 
redirect to the correct destination. Redirecting should not be the 
default, correct links should be default.
Afaics there is another big disadvantage using a forced redirect (at 
least if redirecting because of a default config): users would not be 
possible to use a "always use https" plugin within their browsers.


-- 
Regards
Felix Nagel