src/aphront/site/PhabricatorSite.php

   1 <?php
   2
   3 abstract class PhabricatorSite extends AphrontSite {
   4
   5   public function shouldRequireHTTPS() {
   6     // If this is an intracluster request, it's okay for it to use HTTP even
   7     // if the site otherwise requires HTTPS. It is common to terminate SSL at
   8     // a load balancer and use plain HTTP from then on, and administrators are
   9     // usually not concerned about attackers observing traffic within a
  10     // datacenter.
  11     if (PhabricatorEnv::isClusterRemoteAddress()) {
  12       return false;
  13     }
  14
  15     return PhabricatorEnv::getEnvConfig('security.require-https');
  16   }
  17
  18 }