在 Play 上强制执行 SSL！框架 [英] Enforce SSL on Play! Framework

问题描述

我目前正在使用 Play！1.2.2 及其新的 Netty 客户端框架.

I'm currently using Play! 1.2.2 and its new Netty client framework.

我还没有找到一种简单的方法来强制执行 SSL，尽管可以让 HTTP 和 HTTPS 异步提供服务.有没有与 Play 合作过的人！有强制执行 SSL 的简单方法吗?不确定我是否需要创建重定向，或者是否可以在 conf 文件中快速解决这个问题.

I haven't found a straightforward method to enforce SSL, although can get HTTP and HTTPS to serve asynchronously. Does anyone that's worked with Play! have a straightforward method of enforcing SSL? Not sure if I need to create redirects or if this can be solved quickly in a conf file.

推荐答案

有几种方法可以强制实施 SSL.

There are a couple of ways to enforce SSL.

首先，您可以将所有操作设置为使用 .secure() 方法，例如

Firstly, you can set all your actions to use the .secure() method, for example

<a href="@{Application.index.secure()}">index page</a>

或者，可能也是最好的方法，是通过前端 HTTP 服务器(例如 Apache、Nginx 或 Lighttpd)执行此操作.

Alternatively, and probably the best way, is to do this via a frontend HTTP server, such as Apache, Nginx or Lighttpd.

前端 http 服务器的想法是，您的应用程序在端口 9000 上运行，但无法从外部网络访问.HTTP 负责所有传入请求，并配置为仅接受 HTTPS.HTTPS 由 HTTP 服务器处理，然后请求被转发到 Play.

The idea of the frontend http server, is that your application runs on port 9000, but is not accessible from the outside network. HTTP is responsible for all incoming requests, and is configured to only accept HTTPS. The HTTPS is handled by the HTTP server, and the request is then forwarded on to Play.

这会使您的整个 Play 应用程序正常工作，并且 SSL 被卸载到另一个应用程序.

This leaves your entire Play application to work as normal, and the SSL is offloaded to another application.

同样的方法可以应用于负载平衡器，而不是 HTTP 服务器，但我猜大多数人会选择更便宜的 HTTP 服务器替代方案，除非在公司环境中运行.

This same method can be applied to a load balancer, rather than HTTP server, but I am guessing the majority of people will go with the far cheaper alternative of a HTTP server, unless running in a corporate environment.

这篇关于在 Play 上强制执行 SSL！框架的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！