Wrong `host` parameter value in VM Manager Console URL in reverse proxy setups
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 253
- Forks
- 106
- Avg merge
- 6d 22h
- Merged PRs (30d)
- 12
Description
I'm using a reverse proxy in front of my Unraid server, which results in a failed VM Console connection due to the wrong host parameter value being used for the console URL. That URL is then used to open the console in a new window. A manual fix is currently required for making the connection working again, by fixing the host parameter.
Specific example
I'm using a reverse proxy with unraid.internal and the target of 10.10.10.10 as my Unraid server. Right now
wrong: https://unraid.internal/plugins/dynamix.vm.manager/vnc.html?v=0000000000&resize=scale&autoconnect=true&host=10.10.10.10:443&port=&path=/wsproxy/5701/
correct: https://unraid.internal/plugins/dynamix.vm.manager/vnc.html?v=0000000000&resize=scale&autoconnect=true&host=unraid.internal:443&port=&path=/wsproxy/5701/
NOTE: I do not know how relevant the port itself is in the end, as I haven't seen an Unraid Webserver on a non-standard port yet. It is just included by default in the
Hostheader (see below).
Other Reports
Relevant Code / Infos
The code that generates the URL in question:
https://github.com/unraid/webgui/blob/d2162169f348a611d1e999865bcb6e57e61d11ec/emhttp/plugins/dynamix.vm.manager/include/VMajax.php#L136
Possible headers with priority in that order (from top to bottom):
Forwarded: Modern Standard for communicating the host from a reverse proxy or similar. See RFC 7239 or MDN Reference for details.X-Forwarded-Host: Non-standard but common header to communicate the host via reverse proxy, see MDN Reference.Host: The header used in the current function, ignoring reverse proxy specific headers, see MDN Reference.
NOTE: Would be willing to open a PR, but I'm not familiar with the codebase, nor do I have a development setup for unraid itself, so I'm refraining from doing so for now.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in emhttp/plugins/dynamix.vm.manager/include/VMajax.php around line 136, where the VM console URL is generated. Inspect how the current Host header becomes the URL's host and compare it with the reported Forwarded and X-Forwarded-Host precedence. Done means reverse-proxy requests use the proxy domain in the generated console URL, while the reported direct-server behavior remains correct.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 70/100