Wrong protocol for factory generated URLs

[tayden]

Problem description

I have an instance of Titiler running in a docker container, which is in turn proxied using Apache. The dockerized app is running under HTTP, but the Apache server serves traffic over HTTPS. Requests to https://example.com/titiler are forwarded to the docker container via Apache reverse proxy directives and the TITILER_API_ROOT_PATH environment variable setting.

When I use the /cog/viewer endpoint, data fails to load because the viewer tries to query /cog/info to get some details about the COG it's loading, but gets the protocol wrong for the URL (uses http, when it should be https). This results in a "blocked:mixed-content" error and the COG fails to load (and instead shows a spinner that never stops spinning).

Expected Output

The COG loads

Environment Information

Using Titiler 0.15.5

[tayden]

I think the solution to this is that the factory.url_for method (https://github.com/developmentseed/titiler/blob/main/src/titiler/core/titiler/core/factory.py#L202) needs to more carefully detect the server base_url to accommodate proxied deployments and correctly resolve the protocol. Alternatively, returning relative url paths only might work (e.g. returning /titiler/cog/info instead of https://example.com/titler/cog/info.

[vincentsarago]

Hi @tayden
This seems to be the same issue as #345 and is a starlette issue or more a configuration issue with the proxy

ref https://github.com/developmentseed/titiler/discussions?discussions_q=is%3Aopen+proxy

[tayden]

Awesome, thanks for the help @vincentsarago!

Following #345, the solution in the end was to add FORWARDED_ALLOW_IPS: "*" as an environment variable to my docker config, and then set some headers in my Apache config. Here's the relevant files for anyone coming across this with a similar setup.

Apache config:

<location /titiler>
        RequestHeader set X-Forwarded-Proto expr=%{REQUEST_SCHEME}
        RequestHeader set X-Forwarded-SSL expr=%{HTTPS}
        ProxyPass http://localhost:9096
        ProxyPassReverse http://localhost:9096
</location>

Docker compose file:

version: "3.8"

services:
  titiler:
    image: ghcr.io/developmentseed/titiler:latest
    environment:
      PORT: 8000
      WORKERS_PER_CORE: 1
      TITILER_API_ROOT_PATH: "/titiler"
      FORWARDED_ALLOW_IPS: "*"
    ports:
      - "9096:8000"