Closed emetsger closed 2 years ago
This PR has no dependency differences with the base branch
I'm not exactly sure why, but the change was overwritten when I did a make reset
. I stopped the stack, reset the file to include the change and and am running a make up
now instead. I am wondering why that code didn't survive the reset, though, which is odd.
@jhujasonw and @little9 do either of you want a chance to review this?
There may only be an issue in the cloud since there is a reverse proxy in front of drupal. There may need to be another field or an adjustment to the reverseproxy or both. We can try this and see if further changes are needed.
This change places limitations on the value of the HTTP
Host
header used when making requests to Drupal. Values for theHost
header must match one of the regular expressions:Any other value will be rejected.
Closes https://github.com/jhu-idc/iDC-general/issues/452
To test
make up
) and successfully load the home pagehttps://islandora-idc.traefik.me/
$settings['trusted_host_patterns']
insettings.local.php
, and change^.+\.traefik\.me$
to^moo\.traefik\.me$
idc_drupal_1
container (docker rm -f idc_drupal_1
)docker-compose up -d
You should see a message
The provided host name is not valid for this server.
Discussion
Restricting values of the
Host
header must be done with care so that legitimate access to Drupal is not broken. So this PR allows any value that ends in.traefik.me
or.library.jhu.edu
. That way there's some flexibility in the host names used in development and production environments.If domain names other than
.traefik.me
or.library.jhu.edu
are used, the values for$settings['trusted_host_patterns']
will need to be updated.Because the Traefik proxy will reject hosts it is not configured for, it can actually interfere when testing this PR, so just be aware of that. Traefik will accept any requests to
*.traefik.me
, which is why the test for the PR usesmoo.traefik.me
rather thanlocalhost
orfoo.bar.com
. (Traefik is not used in production).