You are reading a single comment by @itsbruce and its replies. Click here to read the full conversation.
  • Can you serve without SSL if the referrer is Google?
    Or if the referrer is anything other than LFGSS?

    That would be every single page being forced to be non-SSL then.

    Referrer information isn't supplied when you use SSL.

    To be precise (for BQ's benefit, as I know VB knows this), with HTTPS, SSL negotiation happens before the HTTP traffic begins and thus before any headers are sent. Fucks up a number of things (e.g. name-based virtual hosting). HTTP 1.1 did introduce a mechanism for starting a connection in plain text and upgrading to TLS, which would address most of those problems; sadly, there is fuck-all browser support for it.

About

Avatar for itsbruce @itsbruce started