clones/friendica
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #2353 from shtrom/issue757-https-reverse-proxy-headers-on-develop 

Enable SSL on standard and well-known HTTP headers
This commit is contained in:
fabrixxm 2016-06-10 08:36:11 +02:00 committed by GitHub
parent baf68af735 e5c7a0cf93
commit 0f8148a4cb
2 changed files with 38 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
INSTALL.txt
View File

@ -136,7 +136,36 @@ $a->config['system']['addon'] = 'js_upload,poormancron';
and save your changes.
9. (Optional) Reverse-proxying and HTTPS
Friendica looks for some well-known HTTP headers indicating a reverse-proxy
terminating an HTTPS connection. While the standard from RFC 7239 specifies
the use of the `Forwaded` header.
Forwarded: for=192.0.2.1; proto=https; by=192.0.2.2
Friendica also supports a number on non-standard headers in common use.
X-Forwarded-Proto: https
Front-End-Https: on
X-Forwarded-Ssl: on
It is however preferable to use the standard approach if configuring a new server.
In Nginx, this can be done as follows (assuming Friendica runs on port 8080).
location / {
if ( $scheme != https ) { # Force Redirect to HTTPS
return 302 https://$host$uri;
}
proxy_pass http://localhost:8080;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Forwarded "for=$proxy_add_x_forwarded_for; proto=$scheme";
}
#####################################################################

11
boot.php
View File

@ -587,10 +587,15 @@ class App {
$this->scheme = 'http';
if(x($_SERVER,'HTTPS') && $_SERVER['HTTPS'])
$this->scheme = 'https';
elseif(x($_SERVER,'SERVER_PORT') && (intval($_SERVER['SERVER_PORT']) == 443))
if((x($_SERVER,'HTTPS') && $_SERVER['HTTPS']) ||
(x($_SERVER['HTTP_FORWARDED']) && preg_match("/proto=https/", $_SERVER['HTTP_FORWARDED'])) ||
(x($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https') ||
(x($_SERVER['HTTP_X_FORWARDED_SSL']) && $_SERVER['HTTP_X_FORWARDED_SSL'] == 'on') ||
(x($_SERVER['FRONT_END_HTTPS']) && $_SERVER['FRONT_END_HTTPS'] == 'on') ||
(x($_SERVER,'SERVER_PORT') && (intval($_SERVER['SERVER_PORT']) == 443)) // XXX: reasonable assumption, but isn't this hardcoding too much?
) {
$this->scheme = 'https';
}
if(x($_SERVER,'SERVER_NAME')) {
$this->hostname = $_SERVER['SERVER_NAME'];