[https only] LLM settings (PUT) fails in the admin

[pieroit]

How to replicate

Under https all endpoints work fine in the admin, with the exception of the endpoint to PUT the LLM configuration. When hitting "Save" on the config:

• browser complains Mixed Content: The page at 'https://DOMAIN/admin/settings' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://DOMAIN/llm/settings/LLMOpenAIChatConfig'. This request has been blocked; the content must be served over HTTPS., By checkin the browser network console, looks like not the request header, but the response header misses https.
• Also a strange redirect happens in the logs serverside

Observations:

• no problems with all the other https and wss endpoints
• using the same endpoint from the swagger /docs, gives no problem and the config is correctly saved; also no redirect server side.
• maybe the server side redirect is simply due to the / at the end of the endpoint call

[zAlweNy26]

No idea about this, does the error still appear?

[pieroit]

Fixed on develop, coming as release in 1.4.8

[PretzelVector]

Hello,

Did the fix get released in 1.4.8? Using the 1.4.8 container, I am seeing the same behaviour described above (and in the PR) where the admin site is requesting https endpoints that end in a / and is being redirected to the stripped http endpoint resulting in a mixed content block.

While debugging, I verified empirically that X-Forwarded-Proto (and related) are set correctly in my setup.

Thanks, ~PV

[PretzelVector]

Hello,

The underlying issue is that uvicorn does not trust X-Forwarded-Proto by default. You can set the following variables in your chesire-cat-ai/core container to trust the origin proxy:

Env = [
  "UVICORN_PROXY_HEADERS=1"
  "FORWARDED_ALLOW_IPS=192.168.0.0/16"
];

With these environment variables set, the redirect from (for example) /llm/settings/ -> /llm/settings is still present, but the redirect target is using the correct scheme.

Thanks, ~PV

[pieroit]

@PretzelVector thanks