[ckan-dev] Strange redirection problems behind reverse-proxy

Fri Mar 3 17:01:34 UTC 2017

Hello everybody,

I'm encountering some strange problems with redirections on an instance 
running CKAN 2.6.0 on Apache on port 9000 behind Nginx as a reverse-proxy 
on port 80.

For some reason, redirects after a POST request (i.e. after a form is 
submitted) point to Apache (i.e. port 9000) instead of Nginx. The strange 
thing is that this only affects one of my instances, I haven't been able 
to reproduce the issue on a (seemingly) identical test installation.

So far I've managed to find out the following:

- The wrong redirect is generated inside Apache, Nginx only passes it on

- There seems to be nothing wrong w.r.t. CKAN. In particular, the 
controller functions generate relative URLs only (i.e. without a port), 
which they pass on to pylons.controllers.util.redirect (aka 
ckan.lib.base.redirect)

The problem therefore seems to be caused somewhere in the Pylons stack, 
with which I have very little experience.

I had previously changed the HTTP headers that Nginx adds for Apache 
(X-Fowarded-*), which might be related the problem. However, my test 
installation uses the same Nginx configuration and doesn't show the 
problem. Here are the relevant lines from nginx.conf:

      proxy_set_header X-Forwarded-For    $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Host   $host;
      proxy_set_header X-Forwarded-Server $host;
      proxy_set_header X-Forwarded-Port   $server_port;
      proxy_set_header X-Forwarded-Proto  $scheme;
      proxy_set_header Forwarded "for=$remote_addr;proto=$scheme";

I've now run out of ideas what else to check so any pointers are more than 
welcome.

Regards,
Florian
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.okfn.org/pipermail/ckan-dev/attachments/20170303/db073337/attachment-0002.html>