CSS and JS files are retrieved via http, even though plantuml is served via https (since v1-2021-10)

[kaztechSolutions]

Current behavior:

Since v1-2021-10, requesting PlantUml via https (https://plantuml.mydomain.com/) is trying to get resources via http. Here are some example links from the retrieved html document:

<link rel="shortcut icon" href="http://plantuml.mydomain.com/favicon.ico" type="image/x-icon"/>
<link rel="stylesheet" href="http://plantuml.mydomain.com/plantuml.css" />
<link rel="stylesheet" href="http://plantuml.mydomain.com/webjars/codemirror/3.21/lib/codemirror.css" />
<script src="http://plantuml.mydomain.com/webjars/codemirror/3.21/lib/codemirror.js"></script>

Expected behavior:

Like it is the behavior in v1-2021-7, while serving PlantUml via https, resources are retrieved through reverse proxy. Best way IMHO is to use relative addresses instead of absolute ones like the following:

<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon"/>
<link rel="stylesheet" href="/plantuml.css" />
<link rel="stylesheet" href="/webjars/codemirror/3.21/lib/codemirror.css" />
<script src="/webjars/codemirror/3.21/lib/codemirror.js"></script>

Setup:

PlantUml running in docker container with following run command on server with IP 192.168.0.2: docker run -d -p 3020:8080 --restart always --name plantuml plantuml/plantuml-server:jetty-v1.2021.10

Nginx reverse proxy is configured like the following:

        server {
                server_name plantuml.mydomain.com;
                listen 80;
                return 301 https://$server_name$request_uri;
        }
        server {
                server_name plantuml.mydomain.com;
                listen 443 ssl;
                location / {
                        proxy_pass http://192.168.0.2:3020;

                        # Replaces IP address with FQDN, otherwise links would target 192.168..., but client cannot access by IP.
                        proxy_set_header Host $host;
                }
        }

[arnaudroques]

Sure, that's sounds like a good idea. If possible, you could submit a PR and we would be be glad to merge it. Thanks!

[kaztechSolutions]

Of course, I could, but before I dig into this I have two questions to be sure, I am not misunderstanding this:

1) In 2021.7, this was working as expected. Why is this changed? 2) Sure, I am not the only one, using a reverse proxy with https in front of PlantUml. How can others don't have this issue?

Regards!

[HeinrichAD]

@kaztechSolutions try to set proxy_set_header X-Forwarded-Proto $scheme;. I thing this should solve your problem.

I am using the following settings for my nginx reverse proxy and was working at least until recently:

# PlantUML
location /plantuml/ {
    include /etc/nginx/proxy.conf;

    proxy_set_header  HOST               $host/plantuml;
    proxy_set_header  X-Forwarded-Host   $host/plantuml;
    proxy_set_header  X-Forwarded-Proto  $scheme;

    proxy_pass http://plantuml-server:8080/;
}

[arnaudroques]

1. In 2021.7, this was working as expected. Why is this changed?

I guess this commit https://github.com/plantuml/plantuml-server/commit/6cb587e156281a09b07ffa708627376fcc7cd4e9 changes the behaviour.

I must say that we focus on the core library now (that is, plantuml.jar) and we let advanced users to improve this project.

Setting X-Forwarded-Proto sounds like the best solution now. Tell us if it's not working for you.

I've also update the README file with instructions about reverse-proxy. You can update this file if it's incorrect.

[kaztechSolutions]

Hi again,

thanks for the quick responses. On my side, I needed to change the nginx configuration slightly. But I am not sure, if the problem is only on my side. Here is my config:

         server {
                server_name plantuml.mydomain.com;
                listen 80;
                return 301 https://$server_name$request_uri;
        }

        server {
                server_name plantuml..mydomain.com;
                listen 443 ssl;
                location / {
                        proxy_pass http://plantuml-server:3020;
                        proxy_set_header Host                   $host;
                        proxy_set_header X-Forwarded-Host       $host/plantuml;
                        proxy_set_header X-Forwarded-Proto      $scheme;
                }
        }

I needed to change the location /plantuml/ line to location /, otherwise I got a 404. With the posted config I am able to use the newest version, which currently is v1.2021.17.

If this is fine for everyone, I can update the readme file!

Regards!

[arnaudroques]

Hi all, I would like to know what you think about https://github.com/plantuml/plantuml-server/pull/208 ?

[HeinrichAD]

I guess this commit 6cb587e changes the behaviour.

The problem before was, that sometimes the contextpath and sometime the hostpath was used. This led to strange behaviors, like in some cases only some content could not be loaded. The commit 6cb587e changes the usage to hostpath consistently. Maybe we should have done it the other way around and used the contextpath consistently?

[ctn]

I think relative paths should be used wherever possible, to avoid unnecessary inconsistencies.

This is orthogonal to the need for a proxy like nginx to pass along the protocol scheme, which is independently useful.