caddyserver / caddy

Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
https://caddyserver.com
Apache License 2.0
55.53k stars 3.91k forks source link

Reverse Proxy active health checks should not follow redirects by default #6291

Closed francislavoie closed 1 month ago

francislavoie commented 2 months ago

When active health checks are enabled (e.g. health_uri), the HTTP client will follow redirects by default, possibly resulting in confusing errors like this:

{"level":"info","ts":"2024/05/02 14:41:53","logger":"http.handlers.reverse_proxy.health_checker.active","msg":"HTTP request failed","host":"127.0.0.1:8080","error":"Get \"https://127.0.0.1:8080/login\": http: server gave HTTP response to HTTPS client"}

This is a result of the upstream serving a redirect from / to https:// + /login.

We should disable redirects by default in the active health check client, and write an error if a redirect is served when not expected, counting as a failed request.

We should also add a new health_follow_redirects option which toggles on following redirects. I expect this would very rarely be used, but no harm in having the option just in case someone needs it.