Closed (duplicate)
Project:
Drupal core
Version:
8.0.x-dev
Component:
bootstrap system
Priority:
Normal
Category:
Feature request
Assigned:
Unassigned
Issue tags:
Reporter:
Created:
2 Jul 2014 at 14:39 UTC
Updated:
6 Mar 2015 at 17:05 UTC
Jump to comment: Most recent, Most recent file
Comments
Comment #1
t0xicCode commentedThe patch allows
initializeRequestGlobalsto rewrite the base_url scheme if necessary to use links with the correct URI.Comment #2
t0xicCode commentedComment #3
mgiffordSeems to work nicely when I applied this on SimplyTest.me. Haven't done any further work though.
Comment #4
t0xicCode commentedNice with ST.me!
In addition, to exhaustively test the patch, the best way is to setup a local install of d8, install the patch, and configure apache to add the X-Forwarded-Proto with the https value (add
RequestHeader set X-Forwarded-Proto "https"to the vhost configuration). The$base_urlshould be set to an url with the http scheme, andreverse_proxy_proto_changeshould be set to TRUE.From there, absolute urls should be constructed with https.
Comment #5
mparker17As instructed:
RequestHeader set X-Forwarded-Proto "https"in my Apache config,$settings['reverse_proxy_proto_change'] = TRUE;and$base_url = 'http://test_d8.dev';insettings.php, and,https.Without the patch applied, all absolute links in the source (to stylesheets, etc) started with
http(i.e.: used the unmodified$base_url). With the patch applied, all absolute links in the source (to stylesheets, etc) started withhttp(i.e.: used the modified$base_url). I'd say this is working as-intended.The code looks good, but is missing tests.
I initially thought it might be really hard to test this because
$base_urlis a global, but there's already a bunch of tests in\Drupal\Tests\Core\Routing\UrlGeneratorTest::testPathBasedURLGeneration()that test generating URLs with custom$base_urls.\Drupal\Tests\Core\Site\SettingsTestmay also be useful, as it contains examples of how to set$settingswithin a test.Comment #6
t0xicCode commentedI've passed some time debugging this in more details, and I noticed that
initializeRequestGlobalswas called too early in the process for the request to be aware of whether it was behind a reverse proxy (or crypto offloader).To fix that, I've moved the relevant code for this issue in the
\Drupal\Core\EventSubscriber\ReverseProxySubscriberclass.I've also added a test suite which should cover this use-case.
Comment #7
mgiffordNo longer applies.
Comment #8
ravi.khetri commentedReRolled.
Comment #10
t0xicCode commentedReverseProxySubscriber is no more, as we've moved to stackphp #2303673: Implement stackphp; cleanup handlePageCache() and preHandle().
Comment #11
piyuesh23 commentedTest file has already been updated. Re-queuing it for testing.
Comment #12
mgiffordThe latest patch is still using ReverseProxySubscriber() for tests.
Comment #13
sharique commentedHere is updated patch.
Comment #15
t0xicCode commentedAlso added support for the other X-Forwarded-* headers, as they are needed for correct operation.
Comment #16
mparker17I just did a code review. Seems to conform to Drupal coding standards.
A few things I noticed:
Inconsistent variable type usage (TRUE/FALSE vs 1/0).
"127.0.0.2" seems like a "magic number (constant)". Should it be defined in a constant or variable in the test object?
Probably not a big deal in a test.
... other than those things, it looks fine.
Comment #17
mparker17One more thing to note: if you want code committed to Drupal 8.0.x now that we're in beta, you'll need to fill out a Beta Evaluation to determine if it meets the criteria allowed changes during the Drupal 8 beta phase. If it doesn't apply, you'll have to mark it for Drupal 8.1.x. :S
Comment #18
mparker17Also reading through the core gates to see if this issue passes... a couple of notes:
Documentation gate:
X_FORWARDED_*headers? If so, please link to it in both the issue summary and in the code so both the core maintainers looking to commit the changes and folks who stumble across the code in the future can read more about what it does / how it works and confirm you wrote code that uses those standards/best-practices.Performance gate: I don't think you need to do anything (doesn't apply).
Accessibility gate: I don't think you need to do anything (doesn't apply).
Usability gate: I don't think you need to do anything (doesn't apply).
Testing gate: I don't think you need to do anything (already done).
Comment #19
t0xicCode commentedReviewing this, I believe that the issue can be closed, and all work migrated to #313145: Support X-Forwarded-* HTTP headers alternates.