[ckan-dev] Strange redirection problems behind reverse-proxy

[Florian.Brucker at it.karlsruhe.de]

Thanks for your details, Ian! We're running CKAN at the root path, so that 
might not be the exact same issue. I'd still be interested if you happen 
to know which env variables may be part of the problem -- I've previously 
compared the request's env variables right before the redirect between the 
failing and the working instances and didn't spot any suspiciuous 
differences. So may be I overlooked something.


Regards
Florian


"ckan-dev" <ckan-dev-bounces at lists.okfn.org> schrieb am 03.03.2017 
21:19:43:

> Von: Ian Ward <ian at excess.org>
> An: CKAN Development Discussions <ckan-dev at lists.okfn.org>, 
> Datum: 03.03.2017 21:20
> Betreff: Re: [ckan-dev] Strange redirection problems behind 
reverse-proxy
> Gesendet von: "ckan-dev" <ckan-dev-bounces at lists.okfn.org>
> 
> On CKAN 2.5.3 we're still seeing some broken redirects in our
> reverse-proxy setup with CKAN on a non-root path. We're using Apache
> and gunicorn, but we're hoping to replace Apache with nginx soon. I
> haven't had time to trace the cause (and it seems to be happening at
> least three different ways).
> 
> It seems that there are still times where the full URL is being
> guessed by the route library's url_for function based on environment
> variables. We should always generate full URLs based on the
> configuration settings because environment variables can't handle
> root_path settings with languages, and it's always a drag to have to
> configure these things in multiple places.
> 
> On Fri, Mar 3, 2017 at 12:01 PM,  <Florian.Brucker at it.karlsruhe.de> 
wrote:
> > Hello everybody,
> >
> > I'm encountering some strange problems with redirections on an 
instance
> > running CKAN 2.6.0 on Apache on port 9000 behind Nginx as a 
reverse-proxy on
> > port 80.
> >
> > For some reason, redirects after a POST request (i.e. after a form is
> > submitted) point to Apache (i.e. port 9000) instead of Nginx. The 
strange
> > thing is that this only affects one of my instances, I haven't been 
able to
> > reproduce the issue on a (seemingly) identical test installation.
> >
> > So far I've managed to find out the following:
> >
> > - The wrong redirect is generated inside Apache, Nginx only passes it 
on
> >
> > - There seems to be nothing wrong w.r.t. CKAN. In particular, the 
controller
> > functions generate relative URLs only (i.e. without a port), whichthey 
pass
> > on to pylons.controllers.util.redirect (aka ckan.lib.base.redirect)
> >
> > The problem therefore seems to be caused somewhere in the Pylons 
stack, with
> > which I have very little experience.
> >
> > I had previously changed the HTTP headers that Nginx adds for Apache
> > (X-Fowarded-*), which might be related the problem. However, my test
> > installation uses the same Nginx configuration and doesn't show the 
problem.
> > Here are the relevant lines from nginx.conf:
> >
> >       proxy_set_header X-Forwarded-For    $proxy_add_x_forwarded_for;
> >       proxy_set_header X-Forwarded-Host   $host;
> >       proxy_set_header X-Forwarded-Server $host;
> >       proxy_set_header X-Forwarded-Port   $server_port;
> >       proxy_set_header X-Forwarded-Proto  $scheme;
> >       proxy_set_header Forwarded "for=$remote_addr;proto=$scheme";
> >
> > I've now run out of ideas what else to check so any pointers are more 
than
> > welcome.
> >
> >
> > Regards,
> > Florian
> >
> > _______________________________________________
> > ckan-dev mailing list
> > ckan-dev at lists.okfn.org
> > https://lists.okfn.org/mailman/listinfo/ckan-dev
> > Unsubscribe: https://lists.okfn.org/mailman/options/ckan-dev
> >
> _______________________________________________
> ckan-dev mailing list
> ckan-dev at lists.okfn.org
> https://lists.okfn.org/mailman/listinfo/ckan-dev
> Unsubscribe: https://lists.okfn.org/mailman/options/ckan-dev
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.okfn.org/pipermail/ckan-dev/attachments/20170307/695d8b02/attachment-0003.html>