Lost token after a 301 redirection

[dreamkiller52]

Hi,
Not sure t's a influxdb-client bug but try here first.

When trying to push data into influxdb behind a nginx proxy I lost the Authentification token

Specifications:_

• Client Version:1.19
• InfluxDB Version:
• Platform: docker ubuntu

send: b'POST /api/v2/write?org=my_org&bucket=ups&precision=ns HTTP/1.1\r\nHost: influxdb.mydomain.com\r\nAccept-Encoding: identity\r\nContent-Length: 657\r\nContent-Encoding: identity\r\nContent-Type: text/plain\r\nAccept: application/json\r\nAuthorization: Token OnT56TUQYifLi0d-z0HYxzBSBxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxjI-iKwXSw4yGcqfXAu5BOjOm46HH_ngc5Ty5g==\r\nUser-Agent: influxdb-client-python/1.19.0\r\n\r\n'

send: b'ups,hardware=P3:60:J4:0V:HB:,host=NAS,model=Ellipse\ PRO\ 1200,source=NUT battery.charge=100i,battery.runtime=2682i,input.frequency=50,input.voltage=237,input.voltage.extended="no",outlet.1.desc="PowerShare Outlet 1",outlet.1.id=2i,outlet.1.status="on",outlet.1.switchable="no",outlet.2.desc="PowerShare Outlet 2",outlet.2.id=3i,outlet.2.status="on",outlet.2.switchable="no",outlet.desc="Main Outlet",outlet.id=1i,outlet.switchable="no",output.frequency=50,output.frequency.nominal=50i,output.voltage=234,output.voltage.nominal=230i,ups.delay.start=30i,ups.load=11i,ups.power=119i,ups.power.nominal=1200i,ups.realpower=86i,ups.status="OL",ups.timer.start=0i'

reply: 'HTTP/1.1 301 Moved Permanently\r\n'

header: Server: nginx/1.20.1

header: Date: Wed, 28 Jul 2021 07:34:59 GMT

header: Content-Type: text/html

header: Content-Length: 169

header: Connection: keep-alive

header: Location: https://influxdb.mydomain.com/api/v2/write?org=myorg&bucket=ups&precision=ns

send: b'POST /api/v2/write?org=myorg&bucket=ups&precision=ns HTTP/1.1\r\nHost: influxdb.mydomain.com\r\nAccept-Encoding: identity\r\nContent-Length: 657\r\nContent-Encoding: identity\r\nContent-Type: text/plain\r\nAccept: application/json\r\nUser-Agent: influxdb-client-python/1.19.0\r\n\r\n'

send: b'ups,hardware=P3:60:J4:0V:HB:,host=NAS,model=Ellipse\ PRO\ 1200,source=NUT battery.charge=100i,battery.runtime=2682i,input.frequency=50,input.voltage=237,input.voltage.extended="no",outlet.1.desc="PowerShare Outlet 1",outlet.1.id=2i,outlet.1.status="on",outlet.1.switchable="no",outlet.2.desc="PowerShare Outlet 2",outlet.2.id=3i,outlet.2.status="on",outlet.2.switchable="no",outlet.desc="Main Outlet",outlet.id=1i,outlet.switchable="no",output.frequency=50,output.frequency.nominal=50i,output.voltage=234,output.voltage.nominal=230i,ups.delay.start=30i,ups.load=11i,ups.power=119i,ups.power.nominal=1200i,ups.realpower=86i,ups.status="OL",ups.timer.start=0i'

reply: 'HTTP/1.1 401 Unauthorized\r\n'

[bednar]

Hi @dreamkiller52,

thanks for using our client. We will take a look.

Regards

[dreamkiller52]

Let me know if I can help in any way.

[rhajek]

Hi @dreamkiller52,

this looks like a problem with the nginx configuration.

The https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_pass_request_headers config option may help.

[bednar]

Hi @dreamkiller52,

The issue is caused by https://urllib3.readthedocs.io/en/stable/reference/urllib3.util.html?highlight=redirect#urllib3.util.Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT.

We will prepare fixed version of client ASAP... stay tuned.

Regards

[bednar]

The Authorization header is removed when going to different hosts, because otherwise the contents of Authorization is sent to third parties which is a security vulnerability.

If you would like to change this behaviour you can use this workaround before initiliaze the client:

from urllib3 import Retry
Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT = frozenset()
Retry.DEFAULT.remove_headers_on_redirect = Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT

[dreamkiller52]

I'll try this as soon as possible ;)

[Risca]

The Authorization header is removed when going to different hosts, because otherwise the contents of Authorization is sent to third parties which is a security vulnerability.

Unless I missed something, the redirect is to the same host but with https instead of http. Are you sure this isn't a bug in the client?

[kernstock]

We're seeing this problem with version 1.35.0. Omitting the scheme part of the url or giving http:// when connecting to a server which will redirect HTTP to HTTPS causes

influxdb_client.rest.ApiException: (401)
Reason: Unauthorized
[...]
HTTP response body: {"code":"unauthorized","message":"unauthorized access"}

[bednar]

Hi @kernstock,

try to configure urllib3 to keep authorisation headers for HTTP redirects by:

from urllib3 import Retry
Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT = frozenset()
Retry.DEFAULT.remove_headers_on_redirect = Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT

Regards

[kernstock]

Hi @kernstock,

try to configure urllib3 to keep authorisation headers for HTTP redirects by:

from urllib3 import Retry
Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT = frozenset()
Retry.DEFAULT.remove_headers_on_redirect = Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT

Regards

Thanks. In my opinion, this should be default behaviour. Omitting the scheme, giving a valid token and receiving an "Unauthorized" response can be very misleading.

[bednar]

It is caused by urllib3 implementation: https://github.com/urllib3/urllib3/blob/740380c59ca2a7c2dceca19e5dba99f6b7060e62/src/urllib3/connectionpool.py#L573