yahoo-eng-team team mailing list archive

[Dave McCowan <dmccowan@xxxxxxxxx>]

Public bug reported:

When a project is deployed behind a SSL terminating proxy, the version
endpoint returns the wrong URLs.  The returned protocol in the reponse
URLs is  http:// instead of the expected https://.

This is because the response built by versions.py git the host
information only from the incoming req.  If SSL has been terminated by a
proxy, then the information in the req indicates http://.  Other
projects have addressed this by adding the config parameter
secure_proxy_ssl_header = HTTP_X_FORWARDED_PROTO.  This will tell the
project to use the value in X-Forwarded-Proto (https or http) when
building the URLs in the response.  Nova and Keystone support this
configuration option.

** Affects: cinder
     Importance: Medium
         Status: New

** Affects: glance
     Importance: Undecided
         Status: New

** Also affects: glance
   Importance: Undecided
       Status: New

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Glance.
https://bugs.launchpad.net/bugs/1558683

Title:
  Versions endpoint does not support X-Forwarded-Proto

Status in Cinder:
  New
Status in Glance:
  New

Bug description:
  When a project is deployed behind a SSL terminating proxy, the version
  endpoint returns the wrong URLs.  The returned protocol in the reponse
  URLs is  http:// instead of the expected https://.

  This is because the response built by versions.py git the host
  information only from the incoming req.  If SSL has been terminated by
  a proxy, then the information in the req indicates http://.  Other
  projects have addressed this by adding the config parameter
  secure_proxy_ssl_header = HTTP_X_FORWARDED_PROTO.  This will tell the
  project to use the value in X-Forwarded-Proto (https or http) when
  building the URLs in the response.  Nova and Keystone support this
  configuration option.

To manage notifications about this bug go to:
https://bugs.launchpad.net/cinder/+bug/1558683/+subscriptions