aws / aws/apprunner-roadmap

Set additional X-Forwarded- Headers

Open
#52 6 comments 36 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
301
Forks
15
PR merge metrics
No merged PRs in 30d

Description

**Community Note**
* Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do * not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**

The proxy in front of App Runner apps should set a more complete suite of X-Forwarded- HTTP headers. Right now, it looks like only these headers are set:

- X-Forwarded-For
- X-Forwarded-Proto

Adding the following headers would allow modern containerized Rails applications to work better behind the App Runner proxy:

- X-Forwarded-Host
- X-Forwarded-Port
- X-Forwarded-Ssl

**Additional context**

When Rails doesn't have these headers, it causes problems for the CSRF protections automatically baked-in and available in Rails. See https://github.com/rails/rails/issues/22965

**Describe alternatives you've considered**

It is possible to disable the CSRF features in Rails configuration:
```
config.action_controller.forgery_protection_origin_check = false
```

But it doesn't really make sense given that the App Runner proxy already has the necessary information to make the feature work properly.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.