From: Eric Wong <normalperson@yhbt.net>
To: unicorn list <mongrel-unicorn@rubyforge.org>
Subject: Re: X-Forwarded-Proto / X_FORWARDED_PROTO
Date: Tue, 19 Jan 2010 13:43:47 -0800 [thread overview]
Message-ID: <20100119214347.GA8301@dcvr.yhbt.net> (raw)
In-Reply-To: <20100110063218.GA3102@dcvr.yhbt.net>
Eric Wong <normalperson@yhbt.net> wrote:
> Eric Wong <normalperson@yhbt.net> wrote:
> > Iñaki Baz Castillo <ibc@aliax.net> wrote:
> > > In your case it seems valid for me (just an opinnion) as
> > > "HTTP_X_FORWARDED_PROTO: http,https" could mean that the request has been sent
> > > using HTTPS and an intermediary proxy has forwarded it using HTTP. Of course
> > > the final destination (Unicorn application) must be ready to support such
> > > syntax.
> >
> > Is it safe to say that if there's an "https" *anywhere* in the
> > X-Forwarded-Proto chain, that "rack.url_scheme" should be set to
> > "https"? Because I suppose most of the time there's only one
> > (client-facing) proxy using https.
>
> Maybe this will work...
Any feedback on this patch would be appreciated, thanks.
> diff --git a/ext/unicorn_http/global_variables.h b/ext/unicorn_http/global_variables.h
> index e593cf6..6705851 100644
> --- a/ext/unicorn_http/global_variables.h
> +++ b/ext/unicorn_http/global_variables.h
> @@ -74,7 +74,6 @@ void init_globals(void)
> DEF_GLOBAL(server_name, "SERVER_NAME");
> DEF_GLOBAL(server_port, "SERVER_PORT");
> DEF_GLOBAL(server_protocol, "SERVER_PROTOCOL");
> - DEF_GLOBAL(http_x_forwarded_proto, "HTTP_X_FORWARDED_PROTO");
> DEF_GLOBAL(port_80, "80");
> DEF_GLOBAL(port_443, "443");
> DEF_GLOBAL(localhost, "localhost");
> diff --git a/ext/unicorn_http/unicorn_http.rl b/ext/unicorn_http/unicorn_http.rl
> index 6232e2c..f3945b2 100644
> --- a/ext/unicorn_http/unicorn_http.rl
> +++ b/ext/unicorn_http/unicorn_http.rl
> @@ -197,6 +197,14 @@ static void write_value(VALUE req, struct http_parser *hp,
> assert_frozen(f);
> }
>
> + /*
> + * any X-Forwarded-Proto: https means there's an https server in the
> + * proxy chain, and that server is most likely the one that actually
> + * sees the client, so help Rack apps generate URLs with "https"
> + */
> + if (f == g_http_x_forwarded_proto && STR_CSTR_EQ(v, "https"))
> + rb_hash_aset(req, g_rack_url_scheme, v);
> +
> e = rb_hash_aref(req, f);
> if (NIL_P(e)) {
> hp->cont = rb_hash_aset(req, f, v);
> @@ -393,12 +401,7 @@ static void finalize_header(struct http_parser *hp, VALUE req)
>
> /* set rack.url_scheme to "https" or "http", no others are allowed by Rack */
> if (NIL_P(temp)) {
> - temp = rb_hash_aref(req, g_http_x_forwarded_proto);
> - if (!NIL_P(temp) && STR_CSTR_EQ(temp, "https"))
> - server_port = g_port_443;
> - else
> - temp = g_http;
> - rb_hash_aset(req, g_rack_url_scheme, temp);
> + rb_hash_aset(req, g_rack_url_scheme, g_http);
> } else if (STR_CSTR_EQ(temp, "https")) {
> server_port = g_port_443;
> } else {
> @@ -712,5 +715,6 @@ void Init_unicorn_http(void)
> SET_GLOBAL(g_http_transfer_encoding, "TRANSFER_ENCODING");
> SET_GLOBAL(g_content_length, "CONTENT_LENGTH");
> SET_GLOBAL(g_http_connection, "CONNECTION");
> + SET_GLOBAL(g_http_x_forwarded_proto, "X_FORWARDED_PROTO");
> }
> #undef SET_GLOBAL
--
Eric Wong
_______________________________________________
Unicorn mailing list - mongrel-unicorn@rubyforge.org
http://rubyforge.org/mailman/listinfo/mongrel-unicorn
Do not quote signatures (like this one) or top post when replying
prev parent reply other threads:[~2010-01-19 21:43 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-01-09 22:16 X-Forwarded-Proto / X_FORWARDED_PROTO skaar
2010-01-09 22:33 ` Iñaki Baz Castillo
2010-01-09 22:39 ` Eric Wong
2010-01-09 23:29 ` skaar
2010-01-09 23:45 ` Iñaki Baz Castillo
2010-01-10 6:12 ` Eric Wong
2010-01-10 6:32 ` Eric Wong
2010-01-10 11:43 ` John-Paul Bader
2010-01-19 21:43 ` Eric Wong [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://yhbt.net/unicorn/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20100119214347.GA8301@dcvr.yhbt.net \
--to=normalperson@yhbt.net \
--cc=mongrel-unicorn@rubyforge.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://yhbt.net/unicorn.git/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).