Automatic base url detection behind reverse proxy (NatLibFi#905)

Use proxy headers (X-Forwarded-Proto and X-Forwarded-Host) to determine the base url if configured to trust these headers (new configuration option).
danmichaelo · Dec 9, 2019 · a351230 · a351230
1 parent bba726b
commit a351230
Show file tree

Hide file tree

Showing 5 changed files with 23 additions and 1 deletion.
diff --git a/config.ttl.dist b/config.ttl.dist
@@ -33,6 +33,8 @@
     skosmos:serviceName "Skosmos" ;
     # customize the base element. Set this if the automatic base url detection doesn't work. For example setups behind a proxy.
     # skosmos:baseHref "http://localhost/Skosmos/" ;
+    # set this to true to determine the base url from the X-Forwarded-Proto and X-Forwarded-Host headers when running behind a proxy.
+    # skosmos:trustProxyHeaders true ;
     # interface languages available, and the corresponding system locales
     skosmos:languages (
         [ rdfs:label "fi" ; rdf:value "fi_FI.utf8" ]

diff --git a/controller/Controller.php b/controller/Controller.php
@@ -94,9 +94,14 @@ private function guessBaseHref()
         $base_url = preg_replace("!^{$doc_root}!", '', $base_dir);
         $base_url = str_replace('/controller', '/', $base_url);
         $protocol = filter_input(INPUT_SERVER, 'HTTPS', FILTER_SANITIZE_STRING) === null ? 'http' : 'https';
+        $domain = filter_input(INPUT_SERVER, 'SERVER_NAME', FILTER_SANITIZE_STRING);
         $port = filter_input(INPUT_SERVER, 'SERVER_PORT', FILTER_SANITIZE_STRING);
+        if ($this->model->getConfig()->getTrustProxyHeaders()) {
+            $domain = filter_input(INPUT_SERVER, 'HTTP_X_FORWARDED_HOST', FILTER_SANITIZE_STRING) ?: $domain ;
+            $protocol = filter_input(INPUT_SERVER, 'HTTP_X_FORWARDED_PROTO', FILTER_SANITIZE_STRING) ?: $protocol ;
+            $port = filter_input(INPUT_SERVER, 'HTTP_X_FORWARDED_PORT', FILTER_SANITIZE_STRING) ?: $port ;
+        }
         $disp_port = ($port == 80 || $port == 443) ? '' : ":$port";
-        $domain = filter_input(INPUT_SERVER, 'SERVER_NAME', FILTER_SANITIZE_STRING);
         $full_url = "$protocol://{$domain}{$disp_port}{$base_url}";
         return $full_url;
     }

diff --git a/model/GlobalConfig.php b/model/GlobalConfig.php
@@ -356,4 +356,12 @@ public function getCollationEnabled()
     {
         return $this->getBoolean('skosmos:sparqlCollationEnabled', FALSE);
     }
+
+    /**
+     * @return boolean
+     */
+    public function getTrustProxyHeaders()
+    {
+        return $this->getBoolean('skosmos:trustProxyHeaders', FALSE);
+    }
 }
diff --git a/tests/GlobalConfigTest.php b/tests/GlobalConfigTest.php
@@ -56,6 +56,11 @@ public function testGetBaseHref()
         $this->assertEquals("http://tests.localhost/Skosmos/", $this->config->getBaseHref());
     }
 
+    public function testGetTrustProxyHeaders()
+    {
+        $this->assertEquals(true, $this->config->getTrustProxyHeaders());
+    }
+
     public function testGetLanguages()
     {
         $this->assertEquals(array('en' => 'en_GB.utf8'), $this->config->getLanguages());

diff --git a/tests/testconfig.ttl b/tests/testconfig.ttl
@@ -35,6 +35,8 @@
     skosmos:serviceName "Skosmos being tested" ;
     # customize the base element. Set this if the automatic base url detection doesn't work. For example setups behind a proxy.
     skosmos:baseHref "http://tests.localhost/Skosmos/" ;
+    # set this to true to determine the base url from the X-Forwarded-Proto and X-Forwarded-Host headers when running behind a proxy.
+    skosmos:trustProxyHeaders true ;
     # interface languages available, and the corresponding system locales
     skosmos:languages ( [ rdfs:label "en" ; rdf:value "en_GB.utf8" ] ) ;
     # how many results (maximum) to load at a time on the search results page