Sonar behind a HTTPS reverse proxy sometimes fall back to HTTP

Details

  • Type: Bug Bug
  • Status: Closed Closed
  • Priority: Minor Minor
  • Resolution: Fixed
  • Affects Version/s: 1.2, 1.2.1, 1.3
  • Fix Version/s: 1.4, 1.11
  • Component/s: Infrastructure, Web
  • Labels:
    None

Description

I use sonar behind an Apache configured as a HTTPS reverse proxy, and I have the following problems:

  • some URL in the web interfaces are absolute and for them, the scheme part of the URL is "http" instead of "https"
  • the HTTP redirections orders received by the browser have the same problem (scheme is "http")

Issue Links

is related to

Bug - A problem which impairs or prevents the functions of the product. SONAR-1986 Problem with reverse proxy and https

  • Major - Major loss of function.
  • Closed - The issue is considered finished, the resolution is correct. Issues which are not closed can be reopened.
relates to

Bug - A problem which impairs or prevents the functions of the product. SONAR-2296 Sonar behind a HTTPS reverse proxy sometimes fall back to HTTP

  • Minor - Minor loss of function, or other problem where easy workaround is present.
  • Open - The issue is open and ready for the assignee to start work on it.

Activity

Ascending order - Click to sort in descending order
Hide
Permalink
Freddy Mallet added a comment -

Hello Nicolas, I think there is workaround to this issue by using the URL_rewriting Apache Module. Could you confirm that point ?

Freddy

Show
Freddy Mallet added a comment - Hello Nicolas, I think there is workaround to this issue by using the URL_rewriting Apache Module. Could you confirm that point ? Freddy
Hide
Permalink
Nicolas Rougé added a comment -

I tested yesterday version 1.3, standalone mode. This problem remains.
I'll try using Apache mod_rewrite..

Show
Nicolas Rougé added a comment - I tested yesterday version 1.3, standalone mode. This problem remains. I'll try using Apache mod_rewrite..
Hide
Permalink
Simon Brandhof added a comment -

Hi Nicolas, could you give the URLs with absolute path please ?

Show
Simon Brandhof added a comment - Hi Nicolas, could you give the URLs with absolute path please ?
Hide
Permalink
Nicolas Rougé added a comment -

I can only find one absolute URL, the top left link "Projects" which is made with an absolute URL : http://sonar/ in my case
The top right link "Projects" is made with a relative URL : /

Concerning the redirection problem, I'm not currently able to test different Apache configurations, but I think it should be handled with the Header directive (mod_header module), with something like :

Header edit Location ^http: https: early

in Apache configuration.

Show
Nicolas Rougé added a comment - I can only find one absolute URL, the top left link "Projects" which is made with an absolute URL : http://sonar/ in my case The top right link "Projects" is made with a relative URL : / Concerning the redirection problem, I'm not currently able to test different Apache configurations, but I think it should be handled with the Header directive (mod_header module), with something like : 
Header edit Location ^http: https: early
in Apache configuration.
Hide
Permalink
Nicolas Rougé added a comment -

I tested the Apache header directive I gave above, and it works.

I was also able to correct the absolute URL I detected. In war/sonar-web/app/controllers/project_controller.rb, the line 186 is :

result.add_item('Projects', url_for(:controller => 'project', :action => 'index'))

but it should be :

result.add_item('Projects', url_for(:controller => 'project', :action => 'index', :only_path => true))
Show
Nicolas Rougé added a comment - I tested the Apache header directive I gave above, and it works. I was also able to correct the absolute URL I detected. In war/sonar-web/app/controllers/project_controller.rb, the line 186 is : 
result.add_item('Projects', url_for(:controller => 'project', :action => 'index'))
but it should be : 
result.add_item('Projects', url_for(:controller => 'project', :action => 'index', :only_path => true))
Hide
Permalink
Johan Vogelzang added a comment -

We use Sonar 1.10 en still see absolute url's

Home page menu -> "All projects"
Quality Profile page -> Tab "Alert"

But maybe there are more.
Can this issue be reopened?

Show
Johan Vogelzang added a comment - We use Sonar 1.10 en still see absolute url's Home page menu -> "All projects" Quality Profile page -> Tab "Alert" But maybe there are more. Can this issue be reopened?
Hide
Permalink
Johan Vogelzang added a comment -

Found another one:
When not logged in as admin and click on the "Settings" menu item, Sonar tries to redirect to an absolute url : http://[hostname]/[context]/session/new

Show
Johan Vogelzang added a comment - Found another one: When not logged in as admin and click on the "Settings" menu item, Sonar tries to redirect to an absolute url : http://[hostname]/[context]/session/new
Hide
Permalink
Dan Adamson added a comment -

FYI, I ran into this problem also with 1.1.2. Here are some workarounds:

http://siannopollo.blogspot.com/2007/08/rails-and-ssl-https.html

Show
Dan Adamson added a comment - FYI, I ran into this problem also with 1.1.2. Here are some workarounds: http://siannopollo.blogspot.com/2007/08/rails-and-ssl-https.html
Hide
Permalink
Simon Brandhof added a comment -

Hi Dan, which URLs are wrong ?

Show
Simon Brandhof added a comment - Hi Dan, which URLs are wrong ?
Hide
Permalink
Freddy Mallet added a comment -

Here is another useful article to understand the issue : http://www.refreshinglyblue.com/2007/06/13/ruby-on-rails-ssl-ispconfig-apache-mongrel/

The solution is too add the following line to the Apache (Sonar) configuration :

RequestHeader set X_FORWARDED_PROTO ‘https’
Show
Freddy Mallet added a comment - Here is another useful article to understand the issue : http://www.refreshinglyblue.com/2007/06/13/ruby-on-rails-ssl-ispconfig-apache-mongrel/ The solution is too add the following line to the Apache (Sonar) configuration : 
RequestHeader set X_FORWARDED_PROTO ‘https’
Hide
Permalink
André Ribeiro added a comment -

I've come across this problem.

When saving, copying and making a quality profile default.

This should be re-opened.

Show
André Ribeiro added a comment - I've come across this problem. When saving, copying and making a quality profile default. This should be re-opened.
Hide
Permalink
Evgeny Mandrikov added a comment -

Instead of reopening for closed issues with "fix version" we create new issue But could you please switch to mailing list to discuss your issue before? When it would be confirmed as a bug we can create new ticket.

Show
Evgeny Mandrikov added a comment - Instead of reopening for closed issues with "fix version" we create new issue But could you please switch to mailing list to discuss your issue before? When it would be confirmed as a bug we can create new ticket.

People

  • Assignee:
    Simon Brandhof
    Reporter:
    Nicolas Rougé
Vote (0)
Watch (1)

Dates

  • Created:
    Updated:
    Resolved: