Forum OpenACS Development: Security Locations Does Not Address Main Subsite HTTPS with SSL Proxy

Collapse
1: Security Locations Does Not Address Main Subsite HTTPS with SSL Proxy
Posted by Dave Bauer on 09/17/13 11:09 PM
If you are using nginx, for example, to proxy SSL, security::locations will not return

https://mysite.com as a valid internal URL and if some legacy code uses get_referrer to generate a return_url, the redirect will fail.

It seems like security::locations should correctly return an HTTPS url for the main subsite if you are proxying SSL so I created a fix that checks for the proxy parameter

diff --git a/packages/acs-tcl/tcl/security-procs.tcl b/packages/acs-tcl/tcl/security-procs.tcl
index 39ff0f6..d8a88fe 100644
--- a/packages/acs-tcl/tcl/security-procs.tcl
+++ b/packages/acs-tcl/tcl/security-procs.tcl
@@ -1776,8 +1776,14 @@ ad_proc -public security::locations {} {
     lappend locations $insecure_location
     # if we have a secure location, add it
     set host_map_https_port ""
+    set proxy_ssl_p false
+    if { [ns_config "ns/parameters" ReverseProxyMode] == "true" } {
+        if { [ns_set iget [ad_conn headers] X-Forwarded-For] != ""  && [ns_set iget [ad_conn headers] X-SSL-Request] ==
+            set proxy_ssl_p true
+        }
+    }
-    if { $sdriver ne "" } {
+    if { $sdriver ne "" || $proxy_ssl_p} {
         set secure_location "https://${host_name}";
         if {$secure_port ne "" && $secure_port ne "443"}  {
             append secure_location ":$secure_port"
Collapse
2: Re: Security Locations Does Not Address Main Subsite HTTPS with SSL Proxy (response to 1)
Posted by Gustaf Neumann on 09/18/13 10:05 AM
sounds reasonable. i would recommend to use instead of the nested if a multi-line if condition to make the intention clearer, to use non-numeric comparison operators to avoid surprises .. and the X-SSL-Request part is truncated, maybe a cut&paste problem.

An open issue is the secure port, if this is not 443. One needs probably the SystemURL kernel parameter in the proxy cases to contain the https://host:port, so why not use this?