Set additional X-Forwarded- Headers
- Dominant language
- No language data
- Stars
- 301
- Forks
- 15
- PR merge metrics
- No merged PRs in 30d
Description
**Community Note**
* Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do * not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment
**Tell us about your request**
The proxy in front of App Runner apps should set a more complete suite of X-Forwarded- HTTP headers. Right now, it looks like only these headers are set:
- X-Forwarded-For
- X-Forwarded-Proto
Adding the following headers would allow modern containerized Rails applications to work better behind the App Runner proxy:
- X-Forwarded-Host
- X-Forwarded-Port
- X-Forwarded-Ssl
**Additional context**
When Rails doesn't have these headers, it causes problems for the CSRF protections automatically baked-in and available in Rails. See https://github.com/rails/rails/issues/22965
**Describe alternatives you've considered**
It is possible to disable the CSRF features in Rails configuration:
```
config.action_controller.forgery_protection_origin_check = false
```
But it doesn't really make sense given that the App Runner proxy already has the necessary information to make the feature work properly.
Contributor guide
Assessment
This issue has not been assessed yet.