3

Ive been advised that I need to set the RequestHeader X-Forwarded-Proto for a node.js application (NodeBB) to resolve an issue with sessions / csrf tokens.

Here's the relevant excerpt from my apache2 config:

ProxyRequests off

<Proxy *>
    Order allow,deny
    Allow from all

</Proxy>
    RewriteEngine On

RewriteCond %{REQUEST_URI}  ^/socket.io            [NC]
RewriteCond %{QUERY_STRING} transport=websocket    [NC]
RewriteRule /(.*)           ws://127.0.0.1:4566/$1 [P,L]

RequestHeader set X-Forwarded-Proto "http"

ProxyPass / http://127.0.0.1:4566/
ProxyPassReverse / http://127.0.0.1:4566/

Apache version is 2.4.7

through a debugging proxy I can see the following headers in the response

HTTP/1.1 200 OK
Date: Wed, 03 Aug 2016 06:55:15 GMT
Server: Apache
X-Powered-By: Express
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Origin: null
Content-Type: text/html; charset=utf-8
ETag: W/"3626-ETnKpHnKC8ul87CmR6NFUg"
Vary: Accept-Encoding
Content-Encoding: gzip
set-cookie: express.sid=s%3AYq3UdEAd4Cbwhc4-pMTrqqEp8ftUDeiu.CdipRmQptJlhnUG8ZhCSYgq%2FpCR0Kdmqx3Lrm5ABiSc; Domain=removed.com; Path=/; Expires=Wed, 17 Aug 2016 06:55:15 GMT; HttpOnly
Cache-Control: max-age=0, no-store
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked

I think that is coming from Express js i.e. the node app but my understanding is that the Apache proxy directives should be passing a request header TO express so I'm not sure if I should also see the X-Forwarded-Proto header in the response too.

  • ...I assume the problem is that the request header does not appear to being set? What version of Apache are you using? – MrWhite Aug 2 '16 at 10:05
  • i think so but haven't managed to prove that yet – codecowboy Aug 2 '16 at 15:03
  • updated question with apache version. – codecowboy Aug 3 '16 at 5:13
8

It's correct to set this directive like

RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
RequestHeader set "X-Forwarded-SSL" expr=%{HTTPS}

If it doesn't work, you may need to install and enable the module mod_headers.

  • 2
    A code only answer is not very high quality. Please edit your answer to explain the code. How and why does it answer the question? Link to any relevant documentation. – Stephen Ostermiller Jun 29 '17 at 13:06
  • 2
    Just watch which version of Apache 2.4 are you running.. Some very early ones from 2.4.x branch (common in RH7 and Ubuntu) don't support expr yet, so you'll probably need to set constant values. – BrunoJCM Sep 2 '18 at 14:54
  • Had to remove the quotation marks from "X-Forwarded-Proto" resp. "X-Forwarded-SSL" to get it to work … – tanius Dec 31 '18 at 0:14
2

Those response headers you are seeing look fine. You should not expect to the X-Forwarded-Proto header in them.

As you state, that header is set when the request is proxied to the back end. To see that header, you would have to have your backend code look for it and log the value.

It appears that you are setting the header correctly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.