[ckan-dev] Strange redirection problems behind reverse-proxy

[Ian Ward]

On CKAN 2.5.3 we're still seeing some broken redirects in our
reverse-proxy setup with CKAN on a non-root path. We're using Apache
and gunicorn, but we're hoping to replace Apache with nginx soon. I
haven't had time to trace the cause (and it seems to be happening at
least three different ways).

It seems that there are still times where the full URL is being
guessed by the route library's url_for function based on environment
variables. We should always generate full URLs based on the
configuration settings because environment variables can't handle
root_path settings with languages, and it's always a drag to have to
configure these things in multiple places.

On Fri, Mar 3, 2017 at 12:01 PM,  <Florian.Brucker at it.karlsruhe.de> wrote:
> Hello everybody,
>
> I'm encountering some strange problems with redirections on an instance
> running CKAN 2.6.0 on Apache on port 9000 behind Nginx as a reverse-proxy on
> port 80.
>
> For some reason, redirects after a POST request (i.e. after a form is
> submitted) point to Apache (i.e. port 9000) instead of Nginx. The strange
> thing is that this only affects one of my instances, I haven't been able to
> reproduce the issue on a (seemingly) identical test installation.
>
> So far I've managed to find out the following:
>
> - The wrong redirect is generated inside Apache, Nginx only passes it on
>
> - There seems to be nothing wrong w.r.t. CKAN. In particular, the controller
> functions generate relative URLs only (i.e. without a port), which they pass
> on to pylons.controllers.util.redirect (aka ckan.lib.base.redirect)
>
> The problem therefore seems to be caused somewhere in the Pylons stack, with
> which I have very little experience.
>
> I had previously changed the HTTP headers that Nginx adds for Apache
> (X-Fowarded-*), which might be related the problem. However, my test
> installation uses the same Nginx configuration and doesn't show the problem.
> Here are the relevant lines from nginx.conf:
>
>       proxy_set_header X-Forwarded-For    $proxy_add_x_forwarded_for;
>       proxy_set_header X-Forwarded-Host   $host;
>       proxy_set_header X-Forwarded-Server $host;
>       proxy_set_header X-Forwarded-Port   $server_port;
>       proxy_set_header X-Forwarded-Proto  $scheme;
>       proxy_set_header Forwarded          "for=$remote_addr;proto=$scheme";
>
> I've now run out of ideas what else to check so any pointers are more than
> welcome.
>
>
> Regards,
> Florian
>
> _______________________________________________
> ckan-dev mailing list
> ckan-dev at lists.okfn.org
> https://lists.okfn.org/mailman/listinfo/ckan-dev
> Unsubscribe: https://lists.okfn.org/mailman/options/ckan-dev
>