Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Redirects to HTTP when behind HTTPS reverse proxy #406

Closed
dnrce opened this issue Mar 6, 2021 · 1 comment
Closed

Redirects to HTTP when behind HTTPS reverse proxy #406

dnrce opened this issue Mar 6, 2021 · 1 comment

Comments

@dnrce
Copy link
Contributor

dnrce commented Mar 6, 2021

When terminating TLS on a reverse proxy in front of script-server, any redirects returned by script-server should use the HTTPS scheme, but the current behavior is that they use HTTP regardless. https://github.com/bugy/script-server/wiki/Reverse-Proxy-setup says to set the X-Scheme header in this scenario, but it is not respected.

Here's a docker-compose.yml to reproduce the issue:

---
version: '3.1'

services:

  script-server:
    image: bugy/script-server:dev

  reverse-proxy:
    image: caddy:2.3.0
    command:
      - sh
      - -c
      - |
        echo -e 'localhost

        reverse_proxy script-server:5000 {
          header_up X-Scheme {scheme}
        }' | caddy run --adapter caddyfile --config -
    ports:
      - 127.0.0.1:443:443

When querying via HTTPS, script-server issues a redirect back to HTTP:

$ curl -k -v https://localhost 2>&1 | grep -i location:
< location: http://localhost/index.html

(It's also worth noting that X-Scheme is a nonstandard header. X-Forwarded-Proto is the more de-facto standard and the proto directive of the Forwarded header is an actual standard.)

@dnrce dnrce changed the title X-headers aren't honored Redirects to HTTP when behind HTTPS reverse proxy Mar 6, 2021
@bugy bugy added the bug label Mar 8, 2021
@bugy bugy added this to the 1.17.0 milestone Mar 8, 2021
@bugy
Copy link
Owner

bugy commented Mar 16, 2021

Done. I tested it for tornado5 and tornado6, seems to be working.
Now X-Scheme and X-Forwarded-Proto headers are always respected, but no other x-headers

Thanks for the docker compose, was really helpful!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants