The example configuration of authcache_varnish makes use of the HTTP header X-Original-URL, which is sent to the backend request alongside the key request, to preserve the URL for evaluation when the key is present.
This can cause issues if the backend or an intermediate service objects to that particular header name, specifically, some WAF are now filtering for this header after this Symfony CVE https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-ri...
We discovered this on our hosting provider when upgrading to a newer PHP version which caused us to receive a "400 bad request". The fix is simple, just rename the header to a safe and unused name; e.g. X-Authcache-Original-URL.
This is likely to impact very few other sites but I'm documenting it here since it took us quite a while to track this down.
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | 3029599-authcache_varnish_xoriginalurl-2.patch | 2.38 KB | grahl |
Comments
Comment #2
grahlComment #3
sgdev commentedI think this is an acceptable patch. Most probably will not have this issue, but it's a minor change that will work for everyone.
Comment #4
znerol commentedRight. This header does not have any significance for the backend. In principle it could be stripped from the
bereqaltogether. Prefixing it withX-Authcachelike all the other authcache specific custom headers is a sensible change as well.Comment #6
znerol commentedThanks for the patch as well as for the review.