run mode-level protection¶

run mode protection is specified by the RequireSSL attribute after the method name:

    sub process_login :RequireSSL {
        my $self = shift;
    }

Module-level protection¶

You can protect a complete module by setting the 'require_ssl' parameter in your instance script:

    use MyApp;
    my $webapp = MyApp->new(
        PARAMS => {require_ssl => 1}
    );
    $webapp->run();

Redirecting to a protected URL.¶

By default, an error is raised if a request is made to a protected run mode or module using HTTP. However, you can specify that the request is redirected to the HTTPS url by setting the rewrite_to_ssl parameter as long as the requested method is not POST:

    my $webapp = MyApp->new(
        PARAMS => {rewrite_to_ssl => 1}
    );

Turning off checks.¶

If you need to turn off checks, simply set the ignore_check parameter when configuring the plugin (see "config_requiressl" below).

Reverting to HTTP¶

Once a successful request is made to a protected run mode or module, subsequent requests to a non-protected run mode or module will revert to using HTTP. To prevent this from happening, set the parameter keep_in_ssl in the configuration (see "config_requiressl" below)

config_requiressl¶

Optionally configure the plugin in your cgiapp_init method

    $self->config_requiressl(
        keep_in_ssl => 0,
        ignore_check => 0,
    )

Valid parameters are:

• keep_in_ssl - if set, all subsequent requests following one to a protected run mode or module will be via HTTPS.
• ignore_check - ignore SSL schecking. This is useful if your application is deployed in an environment that doesn't support SSL.

mode_redirect¶

This is a run mode that will be automatically called if the request should be redirected to the equivalent HTTP or HTTPS URL. You should not call it directly.