ember-fastboot / ember-fastboot/fastboot
Use X-Forwarded-Proto header as FastbootRequest protocol
- Dominant language
- No language data
- Stars
- 155
- Forks
- 67
- PR merge metrics
- No merged PRs in 30d
Description
I'm not sure if this is the right repo to open this issue, please let me know if it should be moved.
Currently the `fastboot.request.protocol` is used when determining the ember data host to use for ED requests made from fastboot. See: https://github.com/ember-fastboot/ember-cli-fastboot/blob/5ecfe8e90ff07f2318eccecedce19c083b58bd21/fastboot/initializers/ajax.js#L9
It's common for load balancers to do SSL termination before sending a request to the fastboot app server. When this happens the protocol would be HTTP, but the LB would also add an `X-Forwarded-Proto` header to the request.
This creates a problem because the fastboot-app-server thinks the protocol is HTTP, so when the fastboot run Ember app runs an Ember data query it will request data from `http://${host}`, which will most likely 301 to `https://${host}`. Since Ember data is running in fastboot/node, it will not follow redirects, and this leads to Ember data ending up with an empty request that throws an error.
One suggestion is to run the fastboot app server using only HTTPS and not have the LB terminate SSL. While this will fix the problem, not all of us have control over our load balancers. Currently, heroku does SSL termination before forwarding the request, so if you're running fastboot-app-server on heroku you'll always end up with an HTTP protocol + `X-Forwarded-Proto: https` header.
My suggestion would be to have `fastboot.request.protocol` check for an X-Forwarded-Proto header in the request and use that. I think this would lead to less surprises.
cc @kratiahuja @krasnoukhov since I know y'all were discussing this earlier today.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.