GeoNode/geonode — pull request #1315 by garnertb (2013-12-20 01:34:45+00:00)
Title: Improve security for the proxy view.  Fixes #1308.

* In production, the proxy will only respond to hosts listed in the settings.PROXY_ALLOWED_HOSTS tuple and the OGC_SERVER hostname.

* Remove the pass through authentication headers. Pass through authentication headers were getting added to requests outside of their respective realm.

* Add a PROXY_URL setting so administrators can use proxies other than the GeoNode.

* Only forward session cookies to the OWS url since commit ef1cf1 states that session cookies can influence local OWS GetCapabilities requests.