[Kimchi-devel] [PATCH 7/8] websockets: Disallow non-encrypted client connections

From: Aline Manera <alinefm(a)br.ibm.com&gt; As all HTTP requests are redirected to HTTPS, we should only use encryted connections to websockets. Fix it. Signed-off-by: Aline Manera <alinefm(a)br.ibm.com&gt; --- src/kimchi/vnc.py | 3 ++- ui/pages/spice.html.tmpl | 4 ++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/src/kimchi/vnc.py b/src/kimchi/vnc.py index 3339014..002b950 100644 --- a/src/kimchi/vnc.py +++ b/src/kimchi/vnc.py @@ -45,7 +45,8 @@ def new_ws_proxy(): cmd = os.path.join(os.path.dirname(__file__), 'websockify.py') args = ['python', cmd, config.get('display', 'display_proxy_port'), '--target-config', WS_TOKENS_DIR, '--cert', cert, '--key', key, - '--web', os.path.join(paths.ui_dir, 'pages/websockify')] + '--web', os.path.join(paths.ui_dir, 'pages/websockify'), + '--ssl-only'] p = subprocess.Popen(args, close_fds=True) return p diff --git a/ui/pages/spice.html.tmpl b/ui/pages/spice.html.tmpl index 3e43306..d2eb8ca 100644 --- a/ui/pages/spice.html.tmpl +++ b/ui/pages/spice.html.tmpl @@ -59,7 +59,7 @@ } function connect() { - var host, port, token, password, scheme = "ws://", uri; + var host, port, token, password, scheme = "wss://", uri; host = getParameter("listen"); port = getParameter("port"); token = getParameter("token"); @@ -136,4 +136,4 @@ <!-- If DUMPXXX is turned on, dumped images will go here --> </div> </body> -</html> \ No newline at end of file +</html> -- 1.7.10.4