Incorrect SSO URL with reverse proxy

[hdhog]

I use traefik as reverse proxy for warpgate

traefik pass headers Host X-Forwarded-Proto to warpgate. For test headers i replace warpgate to whoami and see this.

Hostname: b3b6d276c624
IP: 127.0.0.1
IP: 172.17.0.2
RemoteAddr: 172.16.11.10:39754
GET / HTTP/1.1
Host: wg.host.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/116.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.5
Cookie: ***
Dnt: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Sec-Gpc: 1
Te: trailers
Uber-Trace-Id: 6f7bcaeb7c5d46db:38dadea1baa77b35:27ac223ed317cf47:1
Upgrade-Insecure-Requests: 1
X-Forwarded-For: ****
X-Forwarded-Host: wg.host.me
X-Forwarded-Port: 443
X-Forwarded-Proto: https
X-Forwarded-Server: 6681ce2d84dd
X-Real-Ip: ***

request contains correct headers

but redirect URL created with port 8888 https://wg.host.me:8888/@warpgate/api/sso/return?code=*&scope=openid+email&state=* instead https://wg.host.me/@warpgate/api/sso/return?code=*&scope=openid+email&state=*

[hdhog]

hm. interesting.

i added this code to construct_external_url

for x in for_request {
    for x in x.headers() {
        print!("{}={:?}\n",x.0,x.1);
    }
}

and don't see Host header

авг 31 20:50:59 srv warpgate[3061522]: referer="https://wg.host.me/@warpgate"
авг 31 20:50:59 srv warpgate[3061522]: x-real-ip="172.16.11.254"
авг 31 20:50:59 srv warpgate[3061522]: sec-fetch-dest="empty"
авг 31 20:50:59 srv warpgate[3061522]: te="trailers"
авг 31 20:50:59 srv warpgate[3061522]: accept-encoding="gzip, deflate, br"
авг 31 20:50:59 srv warpgate[3061522]: x-forwarded-port="443"
авг 31 20:50:59 srv warpgate[3061522]: x-forwarded-server="6681ce2d84dd"
авг 31 20:50:59 srv warpgate[3061522]: x-forwarded-for="172.16.11.254"
авг 31 20:50:59 srv warpgate[3061522]: cookie="authelia_session="
авг 31 20:50:59 srv warpgate[3061522]: sec-fetch-site="same-origin"
авг 31 20:50:59 srv warpgate[3061522]: x-forwarded-proto="https"
авг 31 20:50:59 srv warpgate[3061522]: x-forwarded-host="wg.host.me"
авг 31 20:50:59 srv warpgate[3061522]: user-agent="Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/116.0"
авг 31 20:50:59 srv warpgate[3061522]: accept-language="en-US,en;q=0.5"
авг 31 20:50:59 srv warpgate[3061522]: sec-gpc="1"
авг 31 20:50:59 srv warpgate[3061522]: accept="*/*"
авг 31 20:50:59 srv warpgate[3061522]: uber-trace-id="5945179f14d477c3:5463590d1a2d88b8:11420e04dbdc0268:1"
авг 31 20:50:59 srv warpgate[3061522]: sec-fetch-mode="cors"

if i replace host header to x-forderded-host proxy working correct

maybe able to parameterizing host and proto headers?

[pgodzwa]

As a workaround, you can change http port to 443 in warpgate.yaml config file. This way you receive correct URL in console. Tested with ingress-nginx reverse proxy and warpgate running on my AKS cluster.

[hdhog]

in my case port 443 used by traefik on same host.

[pgodzwa]

in my case port 443 used by traefik on same host.

You don't need to expose 443 warpgate port to host. Just configure traefik reverse proxy on warpgate container so it connects to 443 inside container.

[hdhog]

yes i agree with good workaround, but i use warpgate on host with systemd. and my docker workloads run nomad and expose dynamic ports which discovery with traefik.

i think manual options for reverse proxies make warpgate more flexible on different deploy environments

[Dominion0815]

@Eugeny
The workaround works, it would be nice if the port with proxy was not used in further versions!

[lanrat]

This issue also affects the SSH link when using Warpgate behind a proxy on another port as well.

[Eugeny]

Can you confirm that this is now fixed with the #921's http.trust_x_forwarded_headers option?

[hdhog]

yes it's work corret with traefik