如何确定我的mod_wsgi应用程序是否正在HTTPS上运行？

Question

I've just inherited a Python application which is running under Apache 2.4, mod_wsgi 3.4 and Python 2.7. The same application serves both HTTP and HTTPS requests.

In the existing code, it is trying to determine if the reqeust was HTTPS by checking the environment:

if context.environ.get('HTTPS') not in ['on', '1']:

This check is failing, even when the connection actually was HTTPS. On looking at an extended traceback showing the environment variables, I saw that HTTPS was not actually in the environment passed from Apache.

So my questions are:

• Is this an Apache configuration problem?
• Is this check completely wrong and should be rewritten to check something else? And if so, what?
• Or should I give up and replace Apache with nginx like I really want to do?

Answer 1

Apache's mod_ssl can be configured to set the HTTPS environment variable, but doesn't do so by default for performance reasons.

You could explicitly enable it, but since you're using a WSGI application, it's probably a better idea to check the wsgi.url_scheme environment variable instead; the WSGI spec guarantees its presence, and it won't require any further changes to your application if you do eventually move to nginx.

Answer 2

When using CGI, WSGI or SSI you will need to advise Apache to send the HTTPS header otherwise it will beempty. You can do this with mod_env in the config or .htaccess

<IfModule mod_env.c>
   SetEnv HTTPS on
</IfModule>