Bad value for X-Forward-* headers -- Proxy feature / Apache2 SSL vhosts

**ShortSnow** · May 19th 2018

Hi,

the /configs/debian/apache/parts/domain.tpl sets in case of #SECTION proxy_fwd BEGIN

Code

RequestHeader set X-Forwarded-Proto "http"RequestHeader set X-Forwarded-Port 80

for both vhosts: SSL an not SSL. It would be perfekt if it sets for domain_ssl.conf

Code

RequestHeader set X-Forwarded-Proto "https"RequestHeader set X-Forwarded-Port 443

Is it Possible to set different RequestHeaders via change in domain.tpl or a listener?

My try to add row 4+5 and row 9/10 to ssl_proxy was not succesfull. The "#SECTION ssl_proxy BEGIN" as no effect.

Code: /configs/debian/apache/parts/domain.tp

# SECTION std_fwd BEGIN.
RedirectMatch {FORWARD_TYPE} ^/((?!(?:errors|\.well-known)/).*) {FORWARD}$1
# SECTION std_fwd END.
# SECTION proxy_fwd BEGIN.
RequestHeader set X-Forwarded-Proto "http"
RequestHeader set X-Forwarded-Port 80
# SECTION ssl_proxy BEGIN.
SSLProxyEngine on
RequestHeader set X-Forwarded-Proto "https"
RequestHeader set X-Forwarded-Port 443
# SECTION ssl_proxy END.
ProxyPreserveHost {FORWARD_PRESERVE_HOST}
ProxyPassMatch ^/((?!(?:errors|\.well-known)/).*) {FORWARD}$1 retry=30 timeout=7200
ProxyPassReverse / {FORWARD}
# SECTION proxy_fwd END.
# SECTION fwd END.

Display More

Thanks a lot

ShortSnow

**Nuxwin** · May 19th 2018

@ShortSnow

Quote from ShortSnow

for both vhosts: SSL an not SSL. It would be perfekt if it sets for domain_ssl.conf

It seem that you did found a bug indeed. Both the scheme and port should vary according current context (ssl or not). Here, the headers are static (always the same scheme and port, whatever the context is while for SSL context we would expect https scheme and port 443. Will be fixed in next maintenance release.

Quote from ShortSnow

Is it Possible to set different RequestHeaders via change in domain.tpl or a listener?

Of course, it is possible to override default defined sections in the vhost templates files through a listener but if you don't know our backend API, you'll have hard time to code that listener.

**ShortSnow** · May 19th 2018

Hello Nuxwin,

thanks a lot. I think k a can wait for a fix

Meanwhile i make it with a "dirty" solution at the end of the domain.tpl before the custom includes, because I have only Proxy Sites in this IMSCP.

Code

# SECTION ssl BEGIN.
RequestHeader set X-Forwarded-Proto "https"
RequestHeader set X-Forwarded-Port 433
# SECTION ssl END.

**Nuxwin** · May 20th 2018

@ShortSnow

Fixed in the @konzeptplus github branch. Will be part of next maintenance release.

See: https://github.com/i-MSCP/imsc…aad6c4a8aa90787baa8e52866

Thank you for your report.
Thread closed.

Bad value for X-Forward-* headers -- Proxy feature / Apache2 SSL vhosts

Share

Daily visitors