opf / opf/openproject-docker-compose
Caddyfile.template incorrect configuration cause infinite redirect
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 342
- Forks
- 315
- PR merge metrics
- No merged PRs in 30d
Description
According to caddy's doc https://caddyserver.com/docs/caddyfile/directives/reverse_proxy#defaults
By default, Caddy passes through incoming headers—including Host—to the backend without modifications, with three exceptions:
- It sets or augments the X-Forwarded-For header field.
- It sets the X-Forwarded-Proto header field.
- It sets the X-Forwarded-Host header field.
For these X-Forwarded-* headers, by default, the proxy will ignore their values from incoming requests, to prevent spoofing.
But the Caddyfile.template set these two header incorrectly
Causing the web frontend received the following data, then frontend return 301 redirect to https://openproject.local:8043 infinitely.
Listening on 0.0.0.0 8080
Connection received on 10.89.3.6 58158
GET / HTTP/1.1
Host: openproject.local:8043
User-Agent: curl/8.14.1
Accept: */*
Via: 2.0 Caddy
X-Forwarded-For:
X-Forwarded-Host: openproject.local:8043
X-Forwarded-Proto:
Accept-Encoding: gzip
After remove these two header_up lines, reverse_proxy works as except:
Listening on 0.0.0.0 8080
Connection received on 10.89.3.7 59848
GET / HTTP/1.1
Host: openproject.local:8043
User-Agent: curl/8.14.1
Accept: */*
Via: 2.0 Caddy
X-Forwarded-For: 10.89.3.7
X-Forwarded-Host: openproject.local:8043
X-Forwarded-Proto: https
Accept-Encoding: gzip
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Inspect proxy/Caddyfile.template at the referenced header_up lines and compare them with Caddy's reverse_proxy header defaults. Reproduce the request headers shown in the issue, then verify the configuration no longer causes the web frontend to return an infinite 301 redirect and that forwarded headers contain the expected values.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker-compose
- Domain
- devops, infrastructure
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 52/100