You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2023/02/28 04:04:48 UTC
[Bug 66499] New: 302 redirects when the :scheme header does not match the connection type
https://bz.apache.org/bugzilla/show_bug.cgi?id=66499
Bug ID: 66499
Summary: 302 redirects when the :scheme header does not match
the connection type
Product: Apache httpd-2
Version: 2.4.55
Hardware: PC
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: mod_http2
Assignee: bugs@httpd.apache.org
Reporter: randy@electronsweatshop.com
Target Milestone: ---
Greetings!
I observed that after upgrading httpd from 2.4.54 to 2.4.55, my server has
started to 302 requests.
My topology is that I have haproxy in front of httpd, which is in front of
php-fpm. haproxy is terminating TLS, but it does set the :scheme header to
https when passing the request to httpd.
I observe that httpd is then redirecting with 302. However, from the user's
perspective, they *did* use an https:// scheme when they made the request to
haproxy. Thus, this results in a redirect loop.
I noticed a note in the changelog that seemed relevant for this, and I found
the related commit and a comment in the code:
https://github.com/icing/mod_h2/commit/eef92aa372922f8f4491e9f58d327e6762de626d#diff-fb0096c49677980d95821ee43f691777ce0645add49981d04c542b92980ea533R307-R308
When I read RFC 7540, it doesn't read to me like this is the correct behavior:
https://www.rfc-editor.org/rfc/rfc7540.html
The ":scheme" pseudo-header field includes the scheme portion of
the target URI ([RFC3986], Section 3.1).
":scheme" is not restricted to "http" and "https" schemed URIs. A
proxy or gateway can translate requests for non-HTTP schemes,
enabling the use of HTTP to interact with non-HTTP services.
In my case, where haproxy is in front of httpd, isn't it correct that the
"target URL" does have an https scheme? Isn't it then correct for this header
to be "https" even though the connection is not TLS?
I'm not an expert at http/2, so please excuse any misunderstandings I may have.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 66499] 302 redirects when the :scheme header does not match the connection type
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=66499
Paulo M <me...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC|mentalstring+apache@gmail.c |
|om |
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 66499] 302 redirects when the :scheme header does not match the connection type
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=66499
--- Comment #6 from abernal <ab...@apache.org> ---
Checked against current trunk (f6b14daf42).
The 302 loop described here no longer occurs. r1909769 (mod_http2 2.0.15)
stopped converting a ":scheme" that differs from the connection scheme into an
absolute URI. Only non-http(s) schemes get one now.
Cleartext h2c with ":scheme: https" is served like any other request:
GET /file.txt -> 200
GET /dir -> 301, same as with ":scheme: http"
The Location of that redirect is "http://...". This is not specific to HTTP/2:
core builds redirects from the connection scheme (ap_http_scheme()), so a
cleartext HTTP/1.1 request, even with an absolute "https://..." request target,
gets the same "http://" Location. A backend behind a TLS terminator has to
learn the original scheme from another source, as with HTTP/1.1.
I did not check whether r1909769 has been backported to 2.4.x, so this may be
fixed in trunk only. Unless someone knows of a remaining case, I think this can
be resolved.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 66499] 302 redirects when the :scheme header does not match the connection type
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=66499
--- Comment #2 from Doug Tabacco <ta...@dougtabacco.com> ---
Yeah while not *technically* a bug this appears to be an unexpected behavior
change for cases where Apache is fronted by a reverse proxy handling TLS
termination.
Among other things, this causes the value of the REQUEST_URI variable sent by
mod_proxy_fcgi to be different from versions of Apache prior to 2.4.55.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 66499] 302 redirects when the :scheme header does not match the connection type
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=66499
--- Comment #5 from Stefan Eissing <st...@eissing.org> ---
No, addresses other bugs as well where I also added a comment. Wrong way?
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 66499] 302 redirects when the :scheme header does not match the connection type
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=66499
Paulo M <me...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |mentalstring+apache@gmail.c
| |om
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 66499] 302 redirects when the :scheme header does not match the connection type
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=66499
--- Comment #1 from Randy Barlow <ra...@electronsweatshop.com> ---
For what it's worth, I did find an haproxy issue from some years ago where the
meaning of this header was debated in the context of a proxy that strips TLS:
https://github.com/haproxy/haproxy/issues/77
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 66499] 302 redirects when the :scheme header does not match the connection type
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=66499
--- Comment #4 from Yann Ylavic <yl...@gmail.com> ---
(In reply to Stefan Eissing from comment #3)
> Fixed in r1909769 and proposed to backport to 2.4.x
This fix is actually for bz 66537 only?
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 66499] 302 redirects when the :scheme header does not match the connection type
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=66499
Stefan Eissing <st...@eissing.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |FIXED
Status|NEW |RESOLVED
--- Comment #3 from Stefan Eissing <st...@eissing.org> ---
Fixed in r1909769 and proposed to backport to 2.4.x
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 66499] 302 redirects when the :scheme header does not match the connection type
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=66499
abernal <ab...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |FIXED
Status|REOPENED |RESOLVED
--- Comment #7 from abernal <ab...@apache.org> ---
Closing per comment 6: verified against current trunk, the 302 loop no longer
occurs (r1909769).
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 66499] 302 redirects when the :scheme header does not match the connection type
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=66499
K <re...@ifastnet.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |REOPENED
Resolution|FIXED |---
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 66499] 302 redirects when the :scheme header does not match the connection type
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=66499
Doug Tabacco <ta...@dougtabacco.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |tabacco@dougtabacco.com
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org