%INCLUDE% should support https

I'd like to include content from a url that is "https://user:pw@some-site/blog-search?text=NeedIncludeHttpsUrl". However the %INCLUDE% processing does not support https (ssl) curently.

Test case

Unfortunately it is an internal site, so I can't give you a direct test case.

Environment

-- StanleyKnutson - 01 Sep 2003

Follow up

The https protocol is currently not supported, the docs to not say it is. This sounds like a useful FeatureEnhancementRequest (changed from BugReport)

We can bring that feature into TWiki if someone brings a patch that does not depend too much on heavy weight CPAN libs.

-- PeterThoeny - 02 Sep 2003

I think some use of CPAN libraries will be necessary (e.g. CPAN:IO::Socket::SSL), which in turn normally use OpenSSL (C library) - in my limited experience of Perl and SSL, it's not that easy to get this setup working, at least on CygWin.

-- RichardDonkin - 03 Sep 2003

So this could be made optional, e.g. try to load the libs only when needed (for topic that have an %INCLUDE{"https://...}%), and fail gracefully with an error message if libs are not installed.

-- PeterThoeny - 04 Sep 2003

Rather than reimplement HTTPS why not just wrap curl in a plugin? curl https://www.example.com/url. Correct implemention of the HTTPS protocol is non-trivial, and it's nowhere near as simple as HTTP (it's not just "let's open a socket and sling out a malformed request"). Having HTTPS includes is of course a gigantic security hole for the intended origin site - and allows the intermediary to intercept personal & confidential data. Since HTTP is broken in TWiki, I'd advocate doing the simplist thing possible (wrap curl), doing it well, and not having it a centralised piece of code given the security holes it opens up.

-- MS - 04 Sep 2003