How to properly setup baseUrl in Slim 3.x

[feryardiant]

I'm using Uri::getBaseUrl() in my slim-plates extension, it seems not working properly on my my server when I access it over https and devtools console said.

Mixed Content: The page at 'https://slim-app.projek.xyz/' was loaded over HTTPS, but requested an insecure stylesheet 'http://slim-app.projek.xyz/styles/main.css'. This request has been blocked; the content must be served over HTTPS.

Is it a bug? or just me who can't set it up properly?

EDIT: Just setup https in my local server and dayum, it works :sweat_smile:. I don't know why & I still trying to figure it out. By the way, I'm using heroku.

Thanks

[vlakoff]

Does that server have $_SERVER['HTTPS'] set?

[feryardiant]

Hi @vlakoff, thanks for reply.

On my local setup, yes it has but not on my heroku, dunno why.

[vlakoff]

I suppose it's because Slim doesn't have support for requests by proxies.

Unfortunately this isn't straightforward to implement if you want it to be thorough, and secure (proxies whitelist).

The best implementation by far is Symfony's, see:

• Request function isSecure
• RequestTest function testGetPort
• IpUtils for IP range support

[feryardiant]

Thanks for your help.

I'll take a look. Cheers :smile:

[akrabat]

How are you including main.css?

[feryardiant]

hi @akrabat,

I'm using Plates built-in Asset Extension on my base.tpl, it will only return file path without hostname (e.g. /asset/main.css)

[vlakoff]

• I see href="/styles/main.css?v=..." in page source, and my browsers (Firefox, Chrome) load the file through https, as expected.
• Plates should provide full URIs as they are much more reliable (e.g. with application installed in server subdirectory).

[feryardiant]

@vlakoff that's exactly my probem here.

[tuupola]

You could also just use href="//slim-app.projek.xyz/styles/main.css?v=..." and browser will automagically choose http or https depending on the current page.

[feryardiant]

Hi @tuupola

Thanks for suggestion, but I don't thing it's a good idea to type it manualy and I was expect it should be retrieved from Uri::getBaseUrl().

[tuupola]

What is the problem described in the bug report? Not getting the https protocol from the Uri::getBaseUrl() call or not getting the domain part from the same call? It is not clear to from the description.

I was not suggesting you should manually type something. Just saying that the protocol part is not required in the URL. If you leave it out browser uses the same protocol as the page was requested with. But I guess I misunderstand the original problem.

[feryardiant]

I use Heroku for the demo with custom domain provided by Cloudflare. The problem is Uri::getBaseUrl() doesn't return correct base url in my setup. When I access it using heroku subdomain which is https://slim3app.herokuapp.com/ I got http://slim3app.herokuapp.com and when I access it from https://slim-app.projek.xyz/ I got something like http://slim-app.projek.xyz:12345 (with extra port). I dunno where it come from, as @vlakoff said

Slim doesn't have support for requests by proxies

I also assumed the same thing.

Sorry, I have poor english.

[piotr-cz]

In #1571 I suggested an option to set base URI manually via config option (which in turn may be read from .env file), but still didn't have time to prepare a PR.

[vlakoff]

@feryardiant You may want to try Proxy Scheme and Host detection middleware :raising_hand:

[piotr-cz]

@vlakoff When using URL rewrites (.htaccess), auto-detection fails and it's not possible to set base URL manually.

[vlakoff]

@piotr-cz Could you please provide an example?

Also, I think manual setting of base URL should be considered as a very, very last resort. If it is technically possible to detect the base URL, we should do it to avoid delegating the work to the user.

[vlakoff]

There are middleware for scenarios with proxies: Proxy Scheme and Host detection middleware and Client IP address middleware. They are awaiting to be used and improved :)

If middlewares can solve this issue, then I think it should be closed.

[feryardiant]

Hi @vlakoff,

Thanks for the link, I'll try both.

---

Best :) Fery Wardiyanto

On Thu, Apr 21, 2016 at 6:15 AM, vlakoff notifications@github.com wrote:

(disclaimer: currently drunk so can't go into the details)

There are middleware for scenarios with middlewares: Proxy Scheme and Host detection middleware https://github.com/akrabat/rka-scheme-and-host-detection-middleware and Client IP address middleware https://github.com/akrabat/rka-ip-address-middleware. They are awaiting to be used and improved :)

If middlewares can solve this issue, then I think it should be closed.

— You are receiving this because you were mentioned. Reply to this email directly or view it on GitHub https://github.com/slimphp/Slim/issues/1665#issuecomment-212648094

[silentworks]

I think the middleware solves this issue, otherwise you can manually set the baseUrl.

[piotr-cz]

@silentworks How can I set the baseUrl manually?