[PATCH] Support X_FORWARDED_PROTO header

[John Hampton <pacopablo@…>]

In many proxy configurations, specifically when running tracd behind Nginx, https:// request will get redirected to http://

One solution is to set the base_url in trac.ini. However, this effectively destroys the possibility of having http:// access.

A solution is to simple allow the proxy to set the X_FORWARDED_PROTO header. Attached is a patch to respect the X_FORWARDED_PROTO header.

An example usage in Nginx would be:

location / {
        proxy_pass      http://dev;
        proxy_set_header  X-Forwarded-Proto  https;
}

[John Hampton <pacopablo@…>]

patch to support X_FORWARDED_PROTO

[cmlenz]

This is related to #2553.

[cmlenz]

And #5064.

[cmlenz]

What I don't get about this: if you're using something like mod_proxy_http, it should be rewriting the Host and Location headers. So if you'd have an outgoing request such as:

   301 Moved Temporarily HTTP/1.1
   Location: http://localhost:8080/foo

then the proxy should be translating that to the corresponding outside URL:

   301 Moved Temporarily HTTP/1.1
   Location: https://example.org/foo

(Using ProxyPass and ProxyPassReverse in Apache httpd)

This stuff only works if the absolute URLs generated by Trac match the proxy configuration, which is why we're no longer taking stuff like X_FORWARDED_HOST into account. It seemed like a good idea, but it just throws off the proxy logic.

What am I missing here?

[John Hampton <pacopablo@…>]

Replying to cmlenz:

(Using ProxyPass and ProxyPassReverse in Apache httpd) This stuff only works if the absolute URLs generated by Trac match the proxy configuration, which is why we're no longer taking stuff like X_FORWARDED_HOST into account. It seemed like a good idea, but it just throws off the proxy logic. What am I missing here?

The fact that I'm not using apache ;) I hate apache and think it's crap (an opinion shared by many). So I don't use it. Nginx doesn't work that way. It apparently doesn't do any rewriting of responses. So you simply get redirected to http://

I'll setup an apache instance and see how that handles things.

[cmlenz]

Replying to John Hampton <pacopablo@pacopablo.com>:

Replying to cmlenz:

(Using ProxyPass and ProxyPassReverse in Apache httpd) This stuff only works if the absolute URLs generated by Trac match the proxy configuration, which is why we're no longer taking stuff like X_FORWARDED_HOST into account. It seemed like a good idea, but it just throws off the proxy logic. What am I missing here?

The fact that I'm not using apache ;) I hate apache and think it's crap (an opinion shared by many).

Well, that was just an example for what I consider the correct behavior for a reverse HTTP proxy ;)

It looks like Nginx has a similar construct, and it should even be the default IIUC:

http://wiki.codemongers.com/NginxHttpProxyModule#proxy_redirect

[cboos]

Probably a configuration issue, not for 0.11 anyway.