Steve32
Premium Member
- Joined
- Mar 15, 2014
- Messages
- 137
- Points
- 18
Moved a site behind a proxy and it started bouncing between itself until the browser gave up. Certificate was valid, the proxy was fine, and the site worked perfectly when I hit the origin directly.
TLS terminates at the proxy, so the proxy talks to the origin over plain HTTP. The application looks at its own connection, sees HTTP, and issues a redirect to HTTPS. That redirect goes back through the proxy, which again calls the origin over HTTP. Nothing is broken, it is just two layers each doing the correct thing with different information.
The origin has to read X-Forwarded-Proto instead of checking the connection itself. On WordPress that means setting the HTTPS server variable from that header in wp-config before anything else loads.
One thing to be careful with: that header is trivially forged if you accept it from anywhere. Only honour it when the request actually came from your proxy, matched on source address. Otherwise you have handed anyone the ability to tell your application it is on a secure connection when it is not.
TLS terminates at the proxy, so the proxy talks to the origin over plain HTTP. The application looks at its own connection, sees HTTP, and issues a redirect to HTTPS. That redirect goes back through the proxy, which again calls the origin over HTTP. Nothing is broken, it is just two layers each doing the correct thing with different information.
The origin has to read X-Forwarded-Proto instead of checking the connection itself. On WordPress that means setting the HTTPS server variable from that header in wp-config before anything else loads.
One thing to be careful with: that header is trivially forged if you accept it from anywhere. Only honour it when the request actually came from your proxy, matched on source address. Otherwise you have handed anyone the ability to tell your application it is on a secure connection when it is not.
