flaix
commented
10 months ago Actually, this only happened with Chrome. These are the headers that were passed through the proxy to Gitblit:
Frame 4: 880 bytes on wire (7040 bits), 880 bytes captured (7040 bits) on interface lo, id 0
Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)
Internet Protocol Version 4, Src: 127.0.0.1, Dst: 127.0.0.1
Transmission Control Protocol, Src Port: 35840, Dst Port: 8080, Seq: 1, Ack: 1, Len: 814
Hypertext Transfer Protocol
GET / HTTP/1.0\r\n
[Expert Info (Chat/Sequence): GET / HTTP/1.0\r\n]
[GET / HTTP/1.0\r\n]
[Severity level: Chat]
[Group: Sequence]
Request Method: GET
Request URI: /
Request Version: HTTP/1.0
X-Forwarded-Host: mints.local\r\n
X-Forwarded-Proto: https\r\n
X-Forwarded-Port: 443\r\n
X-Forwarded-For: 10.211.55.2\r\n
Host: 127.0.0.1:8080\r\n
Connection: close\r\n
Cache-Control: max-age=0\r\n
sec-ch-ua: "Chromium";v="118", "Google Chrome";v="118", "Not=A?Brand";v="99"\r\n
sec-ch-ua-mobile: ?0\r\n
sec-ch-ua-platform: "macOS"\r\n
Upgrade-Insecure-Requests: 1\r\n
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36\r\n
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\r\n
Sec-Fetch-Site: none\r\n
Sec-Fetch-Mode: navigate\r\n
Sec-Fetch-User: ?1\r\n
Sec-Fetch-Dest: document\r\n
Accept-Encoding: gzip, deflate, br\r\n
Accept-Language: de,en-GB;q=0.9,en-US;q=0.8,en;q=0.7\r\n
\r\n
[Full request URI: http://127.0.0.1:8080/]
[HTTP request 1/1]
[Response in frame: 6]Chrome puts some 3f characters in there which might cause a problem.
0000 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00 ..............E.
0010 03 62 db 4a 40 00 40 06 5e 49 7f 00 00 01 7f 00 .b.J@.@.^I......
0020 00 01 8c 00 1f 90 55 fa 23 77 7b 85 97 50 80 18 ......U.#w{..P..
0030 02 00 01 57 00 00 01 01 08 0a 59 9d a2 79 59 9d ...W......Y..yY.
0040 a2 78 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 30 .xGET / HTTP/1.0
0050 0d 0a 58 2d 46 6f 72 77 61 72 64 65 64 2d 48 6f ..X-Forwarded-Ho
0060 73 74 3a 20 6d 69 6e 74 73 2e 6c 6f 63 61 6c 0d st: mints.local.
0070 0a 58 2d 46 6f 72 77 61 72 64 65 64 2d 50 72 6f .X-Forwarded-Pro
0080 74 6f 3a 20 68 74 74 70 73 0d 0a 58 2d 46 6f 72 to: https..X-For
0090 77 61 72 64 65 64 2d 50 6f 72 74 3a 20 34 34 33 warded-Port: 443
00a0 0d 0a 58 2d 46 6f 72 77 61 72 64 65 64 2d 46 6f ..X-Forwarded-Fo
00b0 72 3a 20 31 30 2e 32 31 31 2e 35 35 2e 32 0d 0a r: 10.211.55.2..
00c0 48 6f 73 74 3a 20 31 32 37 2e 30 2e 30 2e 31 3a Host: 127.0.0.1:
00d0 38 30 38 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 8080..Connection
00e0 3a 20 63 6c 6f 73 65 0d 0a 43 61 63 68 65 2d 43 : close..Cache-C
00f0 6f 6e 74 72 6f 6c 3a 20 6d 61 78 2d 61 67 65 3d ontrol: max-age=
0100 30 0d 0a 73 65 63 2d 63 68 2d 75 61 3a 20 22 43 0..sec-ch-ua: "C
0110 68 72 6f 6d 69 75 6d 22 3b 76 3d 22 31 31 38 22 hromium";v="118"
0120 2c 20 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 , "Google Chrome
0130 22 3b 76 3d 22 31 31 38 22 2c 20 22 4e 6f 74 3d ";v="118", "Not=
0140 41 3f 42 72 61 6e 64 22 3b 76 3d 22 39 39 22 0d A?Brand";v="99".
0150 0a 73 65 63 2d 63 68 2d 75 61 2d 6d 6f 62 69 6c .sec-ch-ua-mobil
0160 65 3a 20 3f 30 0d 0a 73 65 63 2d 63 68 2d 75 61 e: ?0..sec-ch-ua
0170 2d 70 6c 61 74 66 6f 72 6d 3a 20 22 6d 61 63 4f -platform: "macO
0180 53 22 0d 0a 55 70 67 72 61 64 65 2d 49 6e 73 65 S"..Upgrade-Inse
0190 63 75 72 65 2d 52 65 71 75 65 73 74 73 3a 20 31 cure-Requests: 1
01a0 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 6f ..User-Agent: Mo
01b0 7a 69 6c 6c 61 2f 35 2e 30 20 28 4d 61 63 69 6e zilla/5.0 (Macin
01c0 74 6f 73 68 3b 20 49 6e 74 65 6c 20 4d 61 63 20 tosh; Intel Mac
01d0 4f 53 20 58 20 31 30 5f 31 35 5f 37 29 20 41 70 OS X 10_15_7) Ap
01e0 70 6c 65 57 65 62 4b 69 74 2f 35 33 37 2e 33 36 pleWebKit/537.36
01f0 20 28 4b 48 54 4d 4c 2c 20 6c 69 6b 65 20 47 65 (KHTML, like Ge
0200 63 6b 6f 29 20 43 68 72 6f 6d 65 2f 31 31 38 2e cko) Chrome/118.
0210 30 2e 30 2e 30 20 53 61 66 61 72 69 2f 35 33 37 0.0.0 Safari/537
0220 2e 33 36 0d 0a 41 63 63 65 70 74 3a 20 74 65 78 .36..Accept: tex
0230 74 2f 68 74 6d 6c 2c 61 70 70 6c 69 63 61 74 69 t/html,applicati
0240 6f 6e 2f 78 68 74 6d 6c 2b 78 6d 6c 2c 61 70 70 on/xhtml+xml,app
0250 6c 69 63 61 74 69 6f 6e 2f 78 6d 6c 3b 71 3d 30 lication/xml;q=0
0260 2e 39 2c 69 6d 61 67 65 2f 61 76 69 66 2c 69 6d .9,image/avif,im
0270 61 67 65 2f 77 65 62 70 2c 69 6d 61 67 65 2f 61 age/webp,image/a
0280 70 6e 67 2c 2a 2f 2a 3b 71 3d 30 2e 38 2c 61 70 png,*/*;q=0.8,ap
0290 70 6c 69 63 61 74 69 6f 6e 2f 73 69 67 6e 65 64 plication/signed
02a0 2d 65 78 63 68 61 6e 67 65 3b 76 3d 62 33 3b 71 -exchange;v=b3;q
02b0 3d 30 2e 37 0d 0a 53 65 63 2d 46 65 74 63 68 2d =0.7..Sec-Fetch-
02c0 53 69 74 65 3a 20 6e 6f 6e 65 0d 0a 53 65 63 2d Site: none..Sec-
02d0 46 65 74 63 68 2d 4d 6f 64 65 3a 20 6e 61 76 69 Fetch-Mode: navi
02e0 67 61 74 65 0d 0a 53 65 63 2d 46 65 74 63 68 2d gate..Sec-Fetch-
02f0 55 73 65 72 3a 20 3f 31 0d 0a 53 65 63 2d 46 65 User: ?1..Sec-Fe
0300 74 63 68 2d 44 65 73 74 3a 20 64 6f 63 75 6d 65 tch-Dest: docume
0310 6e 74 0d 0a 41 63 63 65 70 74 2d 45 6e 63 6f 64 nt..Accept-Encod
0320 69 6e 67 3a 20 67 7a 69 70 2c 20 64 65 66 6c 61 ing: gzip, defla
0330 74 65 2c 20 62 72 0d 0a 41 63 63 65 70 74 2d 4c te, br..Accept-L
0340 61 6e 67 75 61 67 65 3a 20 64 65 2c 65 6e 2d 47 anguage: de,en-G
0350 42 3b 71 3d 30 2e 39 2c 65 6e 2d 55 53 3b 71 3d B;q=0.9,en-US;q=
0360 30 2e 38 2c 65 6e 3b 71 3d 30 2e 37 0d 0a 0d 0a 0.8,en;q=0.7....It works with Safari and Firefox, so this might be related to gitblit-org/gitblit#1451
I set up Gitblit to use the HTTP Header authentication provider and defined a header for the user name. Nginx is set up as reverse proxy and it sets the user name from the certificate.
This works when the client provides a certificate. But when a client does not provide a certificate at all, Gitblit ran into an exception.