From ca56fa1b8b9714d47d35cd7a3302d0f25f00af89 Mon Sep 17 00:00:00 2001 From: Bjorn Post Date: Mon, 18 Jan 2021 22:00:13 +0100 Subject: [PATCH] fix: revert doc deletion, revert test_helper change, refs #4339 --- docs/configuration/ssl.md | 6 ++++++ tests/unit/test_helper.bash | 4 ++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/docs/configuration/ssl.md b/docs/configuration/ssl.md index e9b1769de..bfb9409bc 100644 --- a/docs/configuration/ssl.md +++ b/docs/configuration/ssl.md @@ -143,6 +143,12 @@ dokku nginx:set node-js-app trust-x-forwarded-for true dokku nginx:set node-js-app trust-x-forwarded-for false ``` +Only use this option if: +1. All requests are terminated at the load balancer, and forwarded to Nginx +2. The load balancer is configured to send the `X-Forwarded-` headers (this may be off by default) + +If it's possible to make HTTP(S) requests directly to Nginx, bypassing the load balancer, or if the load balancer is not configured to set these headers, then it becomes possible for a client to set these headers to arbitrary values. + ### SSL Port Exposure When your app is served from port `80` then the `/home/dokku/APP/nginx.conf` file will automatically be updated to instruct nginx to respond to ssl on port 443 as a new cert is added. If your app uses a non-standard port (perhaps you have a dockerfile deploy exposing port `99999`) you may need to manually expose an ssl port via `dokku proxy:ports-add https:443:99999`. diff --git a/tests/unit/test_helper.bash b/tests/unit/test_helper.bash index c6c49683b..8d693fd9d 100644 --- a/tests/unit/test_helper.bash +++ b/tests/unit/test_helper.bash @@ -406,7 +406,7 @@ server { proxy_set_header Connection \$http_connection; proxy_set_header Host \$http_host; proxy_set_header X-Forwarded-Proto \$scheme; - proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-For \$remote_addr; proxy_set_header X-Forwarded-Port \$server_port; proxy_set_header X-Request-Start \$msec; } @@ -453,7 +453,7 @@ server { proxy_set_header Connection "upgrade"; proxy_set_header Host \$http_host; proxy_set_header X-Forwarded-Proto \$scheme; - proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-For \$remote_addr; proxy_set_header X-Forwarded-Port \$server_port; proxy_set_header X-Request-Start \$msec; }