Add HttpRequest.scheme property

[nslater]

As it stands, the scheme is located at request["wsgi.url_scheme"] which translates as {{ request.wsgi.url_scheme}} which is invalid for obvious reasons, leaving no way to access this value from the template.

The Request object should be modified to have a "scheme" attritbute.

I could then do this from a template:

<img src="{{ request.scheme }}://{{ site.domain }}/logo"/>

[anonymous]

You could also use a "protocol relative URI" that starts with two slashes: {{ site.domain }}/logo

(For an example in the wild, ibm.com uses this technique.)

[nslater]

Great, thanks for that!

I still think this would be useful though.

[holdenweb]

Given that the scheme is relatively easily deduced from request.is_secure() this seems like it shouldn't really be needed.

[cgieringer]

@holdenweb so now all templates must perform: {% if request.is_secure() %}https{% else %}http{% endif %}?

That's less elegant, and doesn't allow generally for applications that are dealing with other schemes, e.g. a django PBX application that needs to differentiate between a set of schemes in a way that isn't just a binary question: is HTTP, is HTTPS.

[Unai Zalakain]

Patch: ​https://github.com/unaizalakain/django/tree/ticket_7603

HttpRequest.get_scheme() uses self.is_secure() to determine if scheme is 'http' or 'https' wether WSGIRequest.get_scheme() makes use of the 'wsgi.url_scheme' WSGI environ variable.

This provides a handful method to check for current scheme in, for example, templates. It also allows to deal with other schemes.

[Tim Graham]

Comments for improvement on the branch.

[Unai Zalakain]

Comments taken into account, pull request: ​https://github.com/django/django/pull/1730

[Tim Graham]

This looks good to me, but since it's potentially security related I'd like one more +1 before committing.

[Aymeric Augustin]

LGTM.

Why do the docs say "normally" and "usually"? The current implementation is always going to return 'http' or 'https'. Let's avoid vague terms.

[Unai Zalakain]

In fact, scheme is gotten from wsgi.url_scheme WSGI variable. ​The docs state that:

wsgi.url_scheme: A string representing the "scheme" portion of the URL at which the application is being invoked. Normally, this will have the value "http" or "https", as appropriate.

It's true that this will always be http or https but there's no guarantee about it.

[Tim Graham <timograham@…>]

In c7634cd7fe7dc09338fcec0ca48d816a29d791b0:

Fixed #7603 -- Added a 'scheme' property to the HttpRequest object

HttpRequest.scheme is https if settings.SECURE_PROXY_SSL_HEADER is
appropriately set and falls back to HttpRequest._get_scheme() (a hook
for subclasses to implement) otherwise.

WSGIRequest._get_scheme() makes use of the wsgi.url_scheme WSGI
environ variable to determine the request scheme.

HttpRequest.is_secure() simply checks if HttpRequest.scheme is
https.

This provides a way to check the current scheme in templates, for example.
It also allows us to deal with other schemes.

Thanks nslater for the suggestion.