WwwAttach::referer_match and HTTPS

WwwAttach::referer_match and HTTPS

[Leah Neukirchen]

Hi,

I noticed that referer_match in lib/PublicInbox/WwwAttach.pm always
fails over HTTPS on my setup as psgi.url_scheme is set to 'http' in
lib/PublicInbox/HTTPD.pm but I have a HTTPS-terminating proxy in front,
so the referer starts with "https://"
(public-inbox-1.6.1 but same in HEAD afaics.)

Did I forget to set anything, or should referer_match just accept both
http and https?

cu,
-- 
Leah Neukirchen  <leah@vuxu.org>  https://leahneukirchen.org/

Re: WwwAttach::referer_match and HTTPS

[Eric Wong]

Leah Neukirchen <leah@vuxu.org> wrote:
> Hi,
> 
> I noticed that referer_match in lib/PublicInbox/WwwAttach.pm always
> fails over HTTPS on my setup as psgi.url_scheme is set to 'http' in
> lib/PublicInbox/HTTPD.pm but I have a HTTPS-terminating proxy in front,
> so the referer starts with "https://"
> (public-inbox-1.6.1 but same in HEAD afaics.)
> 
> Did I forget to set anything, or should referer_match just accept both
> http and https?

Hmm, yes, probably it should unconditionally accept /\Ahttps?/i
iff psgi.url_scheme eq 'http' given the way common configs are.
psgi.url_scheme seems inconsistent and difficult to rely on with
so many possible forwarding proxies and configurations.

There's the Forwarded: (RFC 7239) header nowadays, and
X-Forwarded-* before, though I suspect X-Forwarded-* remains
widely in use.

Re: WwwAttach::referer_match and HTTPS

[Leah Neukirchen]

Eric Wong <e@80x24.org> writes:

> Leah Neukirchen <leah@vuxu.org> wrote:
>> Hi,
>> 
>> I noticed that referer_match in lib/PublicInbox/WwwAttach.pm always
>> fails over HTTPS on my setup as psgi.url_scheme is set to 'http' in
>> lib/PublicInbox/HTTPD.pm but I have a HTTPS-terminating proxy in front,
>> so the referer starts with "https://"
>> (public-inbox-1.6.1 but same in HEAD afaics.)
>> 
>> Did I forget to set anything, or should referer_match just accept both
>> http and https?
>
> Hmm, yes, probably it should unconditionally accept /\Ahttps?/i
> iff psgi.url_scheme eq 'http' given the way common configs are.
> psgi.url_scheme seems inconsistent and difficult to rely on with
> so many possible forwarding proxies and configurations.
>
> There's the Forwarded: (RFC 7239) header nowadays, and
> X-Forwarded-* before, though I suspect X-Forwarded-* remains
> widely in use.

I currently set

   proxy_set_header X-Forwarded-Host $host;
   proxy_set_header X-Forwarded-Server $host;
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 

but not X-Forwarded-Proto...

-- 
Leah Neukirchen  <leah@vuxu.org>  https://leahneukirchen.org

Re: WwwAttach::referer_match and HTTPS

[Eric Wong]

Leah Neukirchen <leah@vuxu.org> wrote:
> Eric Wong <e@80x24.org> writes:
> 
> > Leah Neukirchen <leah@vuxu.org> wrote:
> >> Hi,
> >> 
> >> I noticed that referer_match in lib/PublicInbox/WwwAttach.pm always
> >> fails over HTTPS on my setup as psgi.url_scheme is set to 'http' in
> >> lib/PublicInbox/HTTPD.pm but I have a HTTPS-terminating proxy in front,
> >> so the referer starts with "https://"
> >> (public-inbox-1.6.1 but same in HEAD afaics.)
> >> 
> >> Did I forget to set anything, or should referer_match just accept both
> >> http and https?
> >
> > Hmm, yes, probably it should unconditionally accept /\Ahttps?/i
> > iff psgi.url_scheme eq 'http' given the way common configs are.

Nevermind, I don't think that change is necessary (see below)

> > psgi.url_scheme seems inconsistent and difficult to rely on with
> > so many possible forwarding proxies and configurations.
> >
> > There's the Forwarded: (RFC 7239) header nowadays, and
> > X-Forwarded-* before, though I suspect X-Forwarded-* remains
> > widely in use.
> 
> I currently set
> 
>    proxy_set_header X-Forwarded-Host $host;
>    proxy_set_header X-Forwarded-Server $host;
>    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 
> 
> but not X-Forwarded-Proto...

Ah, I suggest setting X-Forwarded-Proto.
Plack::Middleware::ReverseProxy (loaded by default) will automatically
parse that and set psgi.url_scheme properly.

(I completely forgot about that middleware :x)

Re: WwwAttach::referer_match and HTTPS

[Leah Neukirchen]

Eric Wong <e@80x24.org> writes:

>> I currently set
>> 
>>    proxy_set_header X-Forwarded-Host $host;
>>    proxy_set_header X-Forwarded-Server $host;
>>    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 
>> 
>> but not X-Forwarded-Proto...
>
> Ah, I suggest setting X-Forwarded-Proto.
> Plack::Middleware::ReverseProxy (loaded by default) will automatically
> parse that and set psgi.url_scheme properly.
>
> (I completely forgot about that middleware :x)

Thanks, that fixes it.

-- 
Leah Neukirchen  <leah@vuxu.org>  https://leahneukirchen.org