Open brknkfr opened 7 months ago
You need to forword all traffic with https (ssl)
internet 443-> nginx 443-> docker
After then you need to set FORCE_HTTPS=true
should you not use Docker then I wonder why you specify an ip in the config ?
You need to forword all traffic with https (ssl)
It should be possible to forward internal traffic on http only. There is no need for an encrypted connection to the backend server in my environment.
internet 443-> nginx 443-> docker
I don't use docker.
After then you need to set FORCE_HTTPS=true
should you not use Docker then I wonder why you specify an ip in the config ?
Because it's the IP address of the internal backend app server where LinkStack is running.
how do you installed linkstack? if you have a webserver so you don't need to forward anything. Like this for http to https
server {
listen 80 default_server;
server_name _;
return 301 https://$host$request_uri;
}
https
server {
listen 443;
listen [::]:443;
server_name example.com;
root /path/to/example.com;
add_header X-Frame-Options "SAMEORIGIN";
add_header X-Content-Type-Options "nosniff";
index index.php;
charset utf-8;
location / {
try_files $uri $uri/ /index.php?$query_string;
}
location = /favicon.ico { access_log off; log_not_found off; }
location = /robots.txt { access_log off; log_not_found off; }
error_page 404 /index.php;
location ~ \.php$ {
fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
include fastcgi_params;
}
location ~ /\.(?!well-known).* {
deny all;
}
location ~ ^\. {
deny all;
}
location ~ \.sqlite$ {
deny all;
}
location ~ \.env$ {
deny all;
}
location ~ /\.htaccess {
allow all;
}
}
I have two webservers: One as public front end server, responsible for ssl termination (https connections) and another one as an internal app server, responsible for the applications (LimeStack, php stuff).
It has to be an issue with the LinkStack karavel proxy configuration or proxy detection. When I set the proxy IP address of the front end server in app/Http/Middleware/TrustProxies.php
with protected $proxies = [ '123.123.123.1'];
where 123.123.123.1 is the IP address of the front end server, the verification links work as expected. So does it with protected $proxies = '*';
See: https://laravel.com/docs/10.x/requests#configuring-trusted-proxies
Setting the trusted proxies via a variable would be desirable.
I've made this change:
<?php
namespace App\Http\Middleware;
use Fideloper\Proxy\TrustProxies as Middleware;
use Illuminate\Http\Request;
class TrustProxies extends Middleware
{
/**
* The trusted proxies for this application.
*
* @var array|string|null
*/
protected $proxies;
/**
* The headers that should be used to detect proxies.
*
* @var int
*/
protected $headers = Request::HEADER_X_FORWARDED_FOR
| Request::HEADER_X_FORWARDED_HOST
| Request::HEADER_X_FORWARDED_PORT
| Request::HEADER_X_FORWARDED_PROTO
| Request::HEADER_X_FORWARDED_AWS_ELB;
/**
* Create a new middleware instance.
*
* @return void
*/
public function __construct()
{
$this->proxies = $this->parseProxies(env('TRUSTED_PROXIES'));
}
/**
* Parse the environment variable containing the trusted proxies.
*
* @param string|null $proxies
* @return array|string|null
*/
protected function parseProxies($proxies)
{
if ($proxies === null) {
return null;
}
if ($proxies === '*') {
return '*'; // Explicitly handle the wildcard case
}
return array_map('trim', explode(',', $proxies));
}
}
LinkStack version
4.7.1
Description
E-Mail verification does not work. It always results in an 403 error. Probably same issue as in https://github.com/LinkStackOrg/LinkStack/issues/591, which is not fixed, but where you can find some possible workarounds.
Details about your system
LEMP stack on a debian bookworm system (nginx 1.22.1, php 8.2.7) with smtp mailing system.
Front end nginx proxy (ssl termination) configuration, listens on
https
and passes requests to backend, listening onhttp
with IP address 123.123.123.1.Back end nginx configuration for LinkStack, only listens on
http
with IP address 123.123.123.1How to reproduce
Configure system as described (debian bookworm with lemp stack)
Ugly workarounds
app/Http/Middleware/TrustProxies.php
withprotected $proxies = '*';
(or set specific IP address of backend server instead of *)Possible Solution
Make LinkStack aware that it could be behind a (ssl) proxy.