Re: WwwAttach::referer_match and HTTPS

[Eric Wong <e@80x24.org>]

Leah Neukirchen <leah@vuxu.org> wrote:
> Eric Wong <e@80x24.org> writes:
> 
> > Leah Neukirchen <leah@vuxu.org> wrote:
> >> Hi,
> >> 
> >> I noticed that referer_match in lib/PublicInbox/WwwAttach.pm always
> >> fails over HTTPS on my setup as psgi.url_scheme is set to 'http' in
> >> lib/PublicInbox/HTTPD.pm but I have a HTTPS-terminating proxy in front,
> >> so the referer starts with "https://"
> >> (public-inbox-1.6.1 but same in HEAD afaics.)
> >> 
> >> Did I forget to set anything, or should referer_match just accept both
> >> http and https?
> >
> > Hmm, yes, probably it should unconditionally accept /\Ahttps?/i
> > iff psgi.url_scheme eq 'http' given the way common configs are.

Nevermind, I don't think that change is necessary (see below)

> > psgi.url_scheme seems inconsistent and difficult to rely on with
> > so many possible forwarding proxies and configurations.
> >
> > There's the Forwarded: (RFC 7239) header nowadays, and
> > X-Forwarded-* before, though I suspect X-Forwarded-* remains
> > widely in use.
> 
> I currently set
> 
>    proxy_set_header X-Forwarded-Host $host;
>    proxy_set_header X-Forwarded-Server $host;
>    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 
> 
> but not X-Forwarded-Proto...

Ah, I suggest setting X-Forwarded-Proto.
Plack::Middleware::ReverseProxy (loaded by default) will automatically
parse that and set psgi.url_scheme properly.

(I completely forgot about that middleware :x)