NGINX reverse proxy with Duo problems

[Caleb Crawford <ca...@ucsd.edu.INVALID>]

Hello all,

I was wondering if anyone else has run into this problem. I have 
guacamole 1.1.0 setup and running and working with no issues if I access 
the app directly. If I access via my nginx reverse proxy some part of 
the duo extension is getting blocked and can't complete authentication 
correctly. On firefox this just gives a spinning wheel graphic, and on 
Chrome it shows up as "this element was blocked by an extension".

I'm fairly sure part of the nginx security options I have is the problem 
but it's a bit outside of my area to identify.

Thanks,

--Caleb


Here's the relevant section of my nginx config:

server {
         listen 443 ssl http2 default_server;
         listen [::]:443 ssl http2 default_server;
         server_name myserver;
         server_tokens off;
         ssl_certificate /path/to/my/cert;
         ssl_certificate_key /path/to/my/key;
     ssl_ciphers 
'TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384';
     ssl_protocols TLSv1.3 TLSv1.2;
         ssl_ecdh_curve secp521r1:secp384r1:prime256v1;
         ssl_prefer_server_ciphers on;
         ssl_session_cache shared:SSL:10m;
         ssl_session_timeout 1d;
         ssl_session_tickets off;
         add_header Referrer-Policy "no-referrer";
         add_header Strict-Transport-Security "max-age=15768000; 
includeSubDomains" always;
     add_header Content-Security-Policy "default-src 'none'; script-src 
'self' 'unsafe-eval'; connect-src 'self'; object-src 'self'; frame-src 
'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; font-src 
'self'; form-action 'self'; base-uri 'self'; frame-ancestors 'self';" 
always;
     add_header X-Frame-Options "SAMEORIGIN" always;
         add_header X-Content-Type-Options "nosniff" always;
         add_header X-XSS-Protection "1; mode=block" always;
         proxy_hide_header Server;
         proxy_hide_header X-Powered-By;
         client_body_timeout 10;
         client_header_timeout 10;

         location / {
         proxy_pass http://myserver/guacamole/;
         proxy_buffering off;
         proxy_http_version 1.1;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection $http_connection;
         proxy_cookie_path /guacamole/ "/; HTTPOnly; Secure; SameSite";
         access_log /var/log/nginx/guac_access.log;
         error_log /var/log/nginx/guac_error.log;
         }
     }


---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org