search

Hobo / hobo

The web app builder for Rails (moved from tablatom/hobo)
http://hobocentral.net
103 stars 39 forks source link

HTTPS Termination causing rapid reorder URL to be incorrect #33

Closed billinghamj closed 11 years ago

billinghamj commented 11 years ago

Hey

Encountering an issue on one of our Hobo systems being caused by a little issue with the URL being outputted.

We terminate SSL at an NginX instance before the request reaches the rails server running the Hobo application.

The URL being outputted in the "data-rapid" attribute is an HTTP URL meaning that jQuery decides the request is crossdomain and makes the request as a GET instead of a POST (due to including it as a script rather than actually using AJAX).

data-rapid attribute

jQuery request attempt

I believe the code causing this issue is in the following file:

https://github.com/Hobo/hobo/blob/master/hobo_jquery_ui/taglibs/sortable_collection.dryml

I think this would probably be fixed by removing the domain part altogether and making the URL relative to the root of the domain. As far as I can think, there is no case in which it would work otherwise anyway.

Does what I've said seem to be correct? If so, I'm happy to have a go at fixing the issue, but if not, could you point me in the right direction? Thanks.

Thanks James

billinghamj commented 11 years ago

Apologies - this was actually a misconfiguration of our NginX reverse proxying configuration.

Since NginX was terminating the SSL, Rails wasn't aware of it being there. The trick is to add the following line which lets Rails in on the secret.

proxy_set_header X-Forwarded-Proto $scheme;

Sorry about that. I'll leave this here for reference of others.