Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
A simple importd
_ based SSL redirector. It accepts requests and redirects
to the SSL version of the same page.
I needed something like this for a couple of sites that were hosted on a shared hosting provider but I wanted to only have one process doing the SSL redirects.
Simply run::
ressl
This launches ressl
on port 8000 using Django's runserver management
command.
For production use it's strongly recommended to instead use a real WSGI server like gunicorn_ or uWSGI_ , e.g.::
gunicorn ressl
To use a different port, use the server's options, e.g.::
gunicorn -b 127.0.0.1:12345 ressl
You must set at least one envrionment variable for ressl to work:
RESSL_ALLOWED_HOSTS
. It's a comma separated list of host names
ressl is allowed to redirect, e.g.::
RESSL_ALLOWED_HOSTS=mycompany.com,myblog.me,myphotos.com gunicorn -b 127.0.0.1:12345 ressl
Debugging is done by setting the environment variable RESSL_DEBUG
to any value::
RESSL_DEBUG=yep gunicorn -b 127.0.0.1:12345 ressl
If your site runs behind a proxy, you may have to tell ressl
how to
figure out if a request is SSL or not. Use the RESSL_PROXY_PROTOCOL
environment variable to define it (defaults to
'HTTP_X_FORWARDED_PROTOCOL'
)::
RESSL_PROXY_PROTOCOL=HTTP_X_FORWARDED_PROTO gunicorn ressl
Feel free to open tickets at https://github.com/jezdez/ressl/issues. Say thanks at https://www.gittip.com/jezdez/.
.. _gunicorn: http://gunicorn.org/ .. _uWSGI: https://github.com/unbit/uwsgi .. _importd: http://pythonhosted.org/importd/
FAQs
A SSL redirector for shared hosting environments, e.g. Webfaction
We found that ressl demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.