ember-fastboot / ember-fastboot/fastboot

Use X-Forwarded-Proto header as FastbootRequest protocol

Open
#161 7 comments 0 reactions 0 assignees View on GitHub
enhancement question
Dominant language
No language data
Stars
155
Forks
67
PR merge metrics
No merged PRs in 30d

Description

I'm not sure if this is the right repo to open this issue, please let me know if it should be moved.

Currently the `fastboot.request.protocol` is used when determining the ember data host to use for ED requests made from fastboot. See: https://github.com/ember-fastboot/ember-cli-fastboot/blob/5ecfe8e90ff07f2318eccecedce19c083b58bd21/fastboot/initializers/ajax.js#L9

It's common for load balancers to do SSL termination before sending a request to the fastboot app server. When this happens the protocol would be HTTP, but the LB would also add an `X-Forwarded-Proto` header to the request.

This creates a problem because the fastboot-app-server thinks the protocol is HTTP, so when the fastboot run Ember app runs an Ember data query it will request data from `http://${host}`, which will most likely 301 to `https://${host}`. Since Ember data is running in fastboot/node, it will not follow redirects, and this leads to Ember data ending up with an empty request that throws an error.

One suggestion is to run the fastboot app server using only HTTPS and not have the LB terminate SSL. While this will fix the problem, not all of us have control over our load balancers. Currently, heroku does SSL termination before forwarding the request, so if you're running fastboot-app-server on heroku you'll always end up with an HTTP protocol + `X-Forwarded-Proto: https` header.

My suggestion would be to have `fastboot.request.protocol` check for an X-Forwarded-Proto header in the request and use that. I think this would lead to less surprises.

cc @kratiahuja @krasnoukhov since I know y'all were discussing this earlier today.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.