Closed pieroit closed 7 months ago
No idea about this, does the error still appear?
Fixed on develop
, coming as release in 1.4.8
Hello,
Did the fix get released in 1.4.8? Using the 1.4.8 container, I am seeing the same behaviour described above (and in the PR) where the admin site is requesting https endpoints that end in a /
and is being redirected to the stripped http endpoint resulting in a mixed content block.
While debugging, I verified empirically that X-Forwarded-Proto
(and related) are set correctly in my setup.
Thanks, ~PV
Hello,
The underlying issue is that uvicorn does not trust X-Forwarded-Proto
by default. You can set the following variables in your chesire-cat-ai/core
container to trust the origin proxy:
Env = [
"UVICORN_PROXY_HEADERS=1"
"FORWARDED_ALLOW_IPS=192.168.0.0/16"
];
With these environment variables set, the redirect from (for example) /llm/settings/
-> /llm/settings
is still present, but the redirect target is using the correct scheme.
Thanks, ~PV
@PretzelVector thanks
How to replicate
Under
https
all endpoints work fine in the admin, with the exception of the endpoint to PUT the LLM configuration. When hitting "Save" on the config:Mixed Content: The page at 'https://DOMAIN/admin/settings' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://DOMAIN/llm/settings/LLMOpenAIChatConfig'. This request has been blocked; the content must be served over HTTPS.
, By checkin the browser network console, looks like not the request header, but the response header misses https
.Observations:
https
andwss
endpoints/docs
, gives no problem and the config is correctly saved; also no redirect server side./
at the end of the endpoint call