You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2019/04/17 04:12:30 UTC
[Bug 63357] New: Allowing generated URLs to be relative
https://bz.apache.org/bugzilla/show_bug.cgi?id=63357
Bug ID: 63357
Summary: Allowing generated URLs to be relative
Product: Apache httpd-2
Version: 2.4-HEAD
Hardware: All
OS: All
Status: NEW
Severity: normal
Priority: P2
Component: All
Assignee: bugs@httpd.apache.org
Reporter: mnot@mnot.net
Target Milestone: ---
Various parts of httpd currently generate the Location response header and
other links as absolute URLs, even when the input (e.g., in a Redirect
directive) is a relative URL, using a call to ap_construct_url().
This can cause operational difficulties for the site if it's deployed with a
reverse proxy or CDN in front of it.
E.g., if the outward-facing site is www.example.com and the origin has a
separate name, origin.example.com, the reverse proxy/CDN will need to rewrite
Location headers and other generated URLs to match the outward-facing site.
RFC7231 specified that relative URLs are allowed in the Location header,
recognising that this was universally supported:
https://httpwg.org/specs/rfc7231.html#header.location
So, it would be very helpful if Apache were to allow these URLs to be generated
as relative, rather than forcing them to be absolute. This would avoid not only
configuration problems when sitting behind a CDN or reverse proxy, but also
avoid the need to rewrite headers, allowing the site to be served more
efficiently.
If changing behaviour is a concern, this could be put behind a configuration
option, although the default should be to allow relative URLs.
AFAICT the affected modules are:
- mod_dav - Location generation in dav_created()
- mod_alias - Location generation in translate_alias_redir() and fixup_redir()
- mod_dir - Location generation in fixup_dir() x2
- mod_imagemap - image map generation in imap_url() x2
- mod_speling - Location generation in check_speling()
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 63357] Allowing generated URLs to be relative
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=63357
Jack <ja...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |jackparke@gmail.com
--- Comment #1 from Jack <ja...@gmail.com> ---
I would like to BUMP this issue. It makes Apache useless as an application
reverse proxy behind say, a corporate reverse proxy.
The solution as follows is at best a hack:
RedirectMatch 301 ^/$ "/cx/"
Header edit Location "(^http[s]?://)([a-zA-Z0-9\.\-]+)(:\d+)?/" "/"
If we configure a redirect to /foo then Apache should not be changing this to a
URI since it reveals an internal domain to an external client which is
unreachable.
https://stackoverflow.com/questions/57993786/apache-httpd-adding-full-hostname-to-redirect-we-want-only-path
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
Re: [Bug 63357] Allowing generated URLs to be relative
Posted by Eric Covener <co...@gmail.com>.
Would we need to split ap_construct_url() into two functions, or could
we change all callers with one flag?
There are two callers that pass "" to get their own absolute URL which
we could handle separately
I can't sort out what mod_imagemap is doing
All the other callers in our repo seem to be applicable.
On Sat, Aug 29, 2020 at 5:04 AM <bu...@apache.org> wrote:
>
> https://bz.apache.org/bugzilla/show_bug.cgi?id=63357
>
> --- Comment #3 from galt@soe.ucsc.edu ---
> nginx supports a flag for relative redirect Location URLs.
>
> There is an nginx directive absolute_redirect available from nginx version
> 1.11.8, which is enabled by default.
> If disabled, redirects issued by nginx will be relative.
>
> absolute_redirect off;
>
> --
> You are receiving this mail because:
> You are the assignee for the bug.
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
> For additional commands, e-mail: bugs-help@httpd.apache.org
>
--
Eric Covener
covener@gmail.com
[Bug 63357] Allowing generated URLs to be relative
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=63357
--- Comment #3 from galt@soe.ucsc.edu ---
nginx supports a flag for relative redirect Location URLs.
There is an nginx directive absolute_redirect available from nginx version
1.11.8, which is enabled by default.
If disabled, redirects issued by nginx will be relative.
absolute_redirect off;
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 63357] Allowing generated URLs to be relative
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=63357
Myeongseob Shim <ma...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |mangsby716@gmail.com
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 63357] Allowing generated URLs to be relative
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=63357
--- Comment #2 from galt@soe.ucsc.edu ---
Bump. Being able to use have Apache return relative URLs in the http response
Location header would make it much easier to test http client code.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org