On 8 February 2018 at 22:34, Kevin Hilman <khilman@baylibre.com> wrote:

Is there a way to make user logins to work whether you're connecting
over HTTP or HTTPS on the same instance?

I know that to get user logins to work without https, you have to add
this to /etc/lava-server/settings.conf:

"CSRF_COOKIE_SECURE": false,
"SESSION_COOKIE_SECURE": false,

But it would be nice if user logins would also work over https at the same time.

The use case for this is an internal LAVA instance that doesn't have
https so internal connections are all over http. The same instance is
also available to the outside world via an nginx reverse proxy with
TLS termination, so connections from outside are over https.

Can it be made to work for both internal (http) and external (https)
connections?

This comes down to nginx, DNS and Django configuration. It's outside the scope of what LAVA can do itself. The Harston lab uses reverse proxy (with Apache) but all access to the instance is using the fully qualified domain name, not localhost. IIRC the lab internal network resolves that without needing to go out and back again. The only time we use localhost is for developer instances on our own laptops.

Django itself cannot be aware of the reverse proxy, so it has one configuration for all requests. I'd recommend that for sites with any external visibility, that should be https.

I would suggest that your lab is reconfigured so that localhost isn't used and that local requests for the instance get routed without going to external DNS. Then the settings to allow localhost logins can be reset to the defaults and everyone uses https, without using localhost, but the routing takes care of avoiding extraneous network traffic.

Neil Williams
=============
neil.williams@linaro.org
http://www.linux.codehelp.co.uk/