ooni / ooni/devops

Investigate potential redirect loop in reverse proxy setup

Open
#126 0 comments 0 reactions 3 assignees View on GitHub

@LDiazN is already working on this.

Since Jan 28, 2025.

Dominant language
HCL
Stars
4
Forks
15
Avg merge
1h 50m
Merged PRs (30d)
4

Description

I noticed this while developing an alternative probe-services client and it's unclear if this is impact real probes, but we should probably look into it.

In order to reproduce the error you can run:

curl -vv -X POST https://backend-fsn.ooni.org/
< HTTP/2 463

or

curl -vv -X POST https://api.ooni.org/
< HTTP/2 463

The culprit here is the following nginx config inside of backend-fsn:

    # match test-helper POST to / and forward traffic to a TH
    if ($request_uri = "/") { set $forward_to_th "YE"; }
    if ($request_method = POST) { set $forward_to_th "${forward_to_th}S"; }
    if ($forward_to_th = "YES") {
      proxy_pass https://0.th.ooni.org;
    }

Which is a catch all for the POST method that redirects to 0.th.ooni.org, however since 0.th.ooni.org is pointing to the ALB instance which matches on the Host header, it will end up into a redirect loop.

It's tempting to just override the Host header in the catch all rule, but the impact of that change is also uncertain.

We should see if we can notice anything unusual in the collected metrics and if so make some attempts at changing it.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.