From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <e@80x24.org>
X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on dcvr.yhbt.net
X-Spam-Level: 
X-Spam-ASN:  
X-Spam-Status: No, score=-4.0 required=3.0 tests=ALL_TRUSTED,BAYES_00
	shortcircuit=no autolearn=ham autolearn_force=no version=3.4.2
Received: from localhost (dcvr.yhbt.net [127.0.0.1])
	by dcvr.yhbt.net (Postfix) with ESMTP id CF9B61F8C6;
	Sun,  8 Aug 2021 01:00:18 +0000 (UTC)
Date: Sun, 8 Aug 2021 01:00:18 +0000
From: Eric Wong <e@80x24.org>
To: Leah Neukirchen <leah@vuxu.org>
Cc: meta@public-inbox.org
Subject: Re: WwwAttach::referer_match and HTTPS
Message-ID: <20210808010018.GA4695@dcvr>
References: <87h7g2aa6z.fsf@vuxu.org>
 <20210806204132.GB25682@dcvr>
 <878s1e9u1c.fsf@vuxu.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
In-Reply-To: <878s1e9u1c.fsf@vuxu.org>
List-Id: <meta.public-inbox.org>

Leah Neukirchen <leah@vuxu.org> wrote:
> Eric Wong <e@80x24.org> writes:
> 
> > Leah Neukirchen <leah@vuxu.org> wrote:
> >> Hi,
> >> 
> >> I noticed that referer_match in lib/PublicInbox/WwwAttach.pm always
> >> fails over HTTPS on my setup as psgi.url_scheme is set to 'http' in
> >> lib/PublicInbox/HTTPD.pm but I have a HTTPS-terminating proxy in front,
> >> so the referer starts with "https://"
> >> (public-inbox-1.6.1 but same in HEAD afaics.)
> >> 
> >> Did I forget to set anything, or should referer_match just accept both
> >> http and https?
> >
> > Hmm, yes, probably it should unconditionally accept /\Ahttps?/i
> > iff psgi.url_scheme eq 'http' given the way common configs are.

Nevermind, I don't think that change is necessary (see below)

> > psgi.url_scheme seems inconsistent and difficult to rely on with
> > so many possible forwarding proxies and configurations.
> >
> > There's the Forwarded: (RFC 7239) header nowadays, and
> > X-Forwarded-* before, though I suspect X-Forwarded-* remains
> > widely in use.
> 
> I currently set
> 
>    proxy_set_header X-Forwarded-Host $host;
>    proxy_set_header X-Forwarded-Server $host;
>    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 
> 
> but not X-Forwarded-Proto...

Ah, I suggest setting X-Forwarded-Proto.
Plack::Middleware::ReverseProxy (loaded by default) will automatically
parse that and set psgi.url_scheme properly.

(I completely forgot about that middleware :x)