OpenTreeOfLife/opentree — pull request #513 by jimallman (2014-12-17 04:16:24+00:00)
Title: Force HTTPS (session protection) in web2py

This uses the same deployment test (existence of our wildcard SSL certificate file) as our Apache configuration. If the cert is found, sets a config variable in both web apps (the synthetic tree browser and the curation app) that forces HTTPS for all requests. This is needed to protect session cookies and prevent hijacking of sessions.

I tried to be more selective and use HTTPS for anonymous requests, but it seems web2py wants this to be all-or-nothing, since even anonymous visitors use a session. See commit messages for more details.