[#9756] - Joomla fallback to HTTP instead of HTTPS on NLB with empty live_site variable
- Closed
- 22 May 2019
- Medium
- Build: master
- # 9756
Steps to reproduce the issue
- must have NLB
- make $live_site variable empty in the configuration.php
- check JUri::base() - it will return http:// as $_SERVER['https'] is not defined even by accessing the site via https protocol
Expected result
Joomla should correctly define http/https via NLB. Change JURi::base() to detect HTTPS by using HTTP_X_FORWARDED_PROTO instead.
Actual result
On NLB apache returns $_REQUEST[https] empty,by having live_site configuration variable not setted, fallback to the http protocol on https site.
System information (as much as possible)
PHP Built On Linux 3.0.101-0.47.71-default #1 SMP Thu Nov 12 12:22:22 UTC 2015 (b5b212e) x86_64
Database Version 5.5.47
PHP Version 5.3.17
Web Server Apache/2.2.12 (Linux/SUSE) PHP/5.3.17
WebServer to PHP Interface apache2handler
Joomla! Version Joomla! 3.4.6 Stable [ Ember ] 15-December-2015 11:11 GMT
Joomla! Platform Version Joomla Platform 13.1.0 Stable [ Curiosity ] 24-Apr-2013 00:00 GMT
| Labels |
Added:
?
|
||
Hi Brian! Sorry for missed details. NLB is a Network Load Balancer.
http://stackoverflow.com/questions/11650640/why-isnt-serverhttps-set-to-1 here are some similar issues.
I think this part of the code fallback to the HTTP even if you are in HTTPS
https://github.com/joomla/joomla-cms/blob/staging/libraries/joomla/uri/uri.php#L65-L67
Oh! I have just found this - exactly the same issue and looks like still not resolved
https://developer.joomla.org/joomlacode-archive/issue-30885.html
| Category | ⇒ | Libraries Router / SEF |
Basically the SSL is terminated at the load balancer, (The load balancer holds the SSL Certificate and intercepts all traffic on https/443 and then acts as a proxy to the webserver on http/80) and then all traffic from the load balancer to the web server is NOT https (and therefor theoretically insecure data passed over a network from the load balancer to the web server) as the web server is running Joomla on standard http/80
Seen this repeatedly over the years
Theoretically its an easy fix - but one that takes a lot of set up (network wise) to replicate, debug, and code for all cases, and a one that takes a lot of testing, for all known use case scenarios...
This is still an issue! I have now fixed this by just bluntly adding $_SERVER['HTTPS'] = 'on'; in the main index.php file, because all traffic is forced to SSL anyways, but I am waiting for a solution!
I have my Joomla CMS on Amazon Elastic Beanstalk with PHP 7.0...
franz-wohlkoenig
- | Status | New | ⇒ | Needs Review |
rdeutz
- | Status | Needs Review | ⇒ | Pending |
Is there any progress on this?
I am also having this issue (being behind a loadbalancer that offloads SSL, but I'm not on AWS).
My current workaround is placing $_SERVER['https'] = 'on'; at the top of my index.php but that solution might break after an update.
Any update would be much appreciated!
| Labels |
Added:
J3 Issue
|
||
I've made a commit to joomla-framework/application (joomla-framework/application#82), which should resolve this.
Does someone know of any more places this should be fixed?
I was thinking about https://github.com/joomla-framework/uri/blob/master/src/AbstractUri.php -> isSSL(), but i don't know if it should be changed there.
The Uri object shouldn't be changed. That should be reporting the state of the URI which the object represents, not the global request.
| Closed_By | alikon | ⇒ | joomla-cms-bot |
| Labels | |||
| Status | Pending | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2019-05-22 10:33:06 |
| Closed_By | ⇒ | alikon | |
| Labels | |||
Set to "closed" on behalf of @alikon by The JTracker Application at issues.joomla.org/joomla-cms/9756
closing as joomla-framework/application#82 has been merged
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/9756.
closing as joomla-framework/application#82 has been merged
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/9756.
Excuse my ignorance - what is NLB?