opf / opf/openproject-docker-compose

Caddyfile.template incorrect configuration cause infinite redirect

Open
#120 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Shell
Stars
342
Forks
315
PR merge metrics
No merged PRs in 30d

Description

According to caddy's doc https://caddyserver.com/docs/caddyfile/directives/reverse_proxy#defaults

By default, Caddy passes through incoming headers—including Host—to the backend without modifications, with three exceptions:

For these X-Forwarded-* headers, by default, the proxy will ignore their values from incoming requests, to prevent spoofing.

But the Caddyfile.template set these two header incorrectly

https://github.com/opf/openproject-docker-compose/blob/9104e069820bb3470088c391465a1c150cdbbdc4/proxy/Caddyfile.template#L10-L11

Causing the web frontend received the following data, then frontend return 301 redirect to https://openproject.local:8043 infinitely.

Listening on 0.0.0.0 8080
Connection received on 10.89.3.6 58158
GET / HTTP/1.1
Host: openproject.local:8043
User-Agent: curl/8.14.1
Accept: */*
Via: 2.0 Caddy
X-Forwarded-For: 
X-Forwarded-Host: openproject.local:8043
X-Forwarded-Proto: 
Accept-Encoding: gzip

After remove these two header_up lines, reverse_proxy works as except:

Listening on 0.0.0.0 8080
Connection received on 10.89.3.7 59848
GET / HTTP/1.1
Host: openproject.local:8043
User-Agent: curl/8.14.1
Accept: */*
Via: 2.0 Caddy
X-Forwarded-For: 10.89.3.7
X-Forwarded-Host: openproject.local:8043
X-Forwarded-Proto: https
Accept-Encoding: gzip

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Inspect proxy/Caddyfile.template at the referenced header_up lines and compare them with Caddy's reverse_proxy header defaults. Reproduce the request headers shown in the issue, then verify the configuration no longer causes the web frontend to return an infinite 301 redirect and that forwarded headers contain the expected values.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker-compose
Domain
devops, infrastructure
Issue type
Bug
Difficulty
1/5
Estimated time
Under an hour
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.