HTTPS on load balancer

Re: HTTPS on load balancer

Schurki — Sat, 10 Dec 2016 15:54:18 -0500

If you read my first posting, you should notice that this is a request that somebody implements it correctly. I just put my changes there as hints how it could be done.

Re: HTTPS on load balancer

Oliver Riesen-Mallmann — Wed, 07 Dec 2016 07:17:59 -0500

Hi Schurki,

Quote
Schurki
I've tried that module first, it's not working.

Nevertheless you should implement your needs as a new module (perhaps based on the Automatic HTTP Path Module) instead of patching the Phorum core...

Regards
Oliver

Re: HTTPS on load balancer

Schurki — Thu, 01 Dec 2016 17:32:08 -0500

I've tried that module first, it's not working. In my setup, the user@browser kann choose if he wants to use HTTPS or HTTP, but the LB forwards all incoming requests, even HTTPS, as HTTP to the web servers. Additionally, Phorum ist accessed through 2 different domains, one accessible only internally for admin tasks, and one external, where admin stuff is blocked by server config. The configured http_path points to the external domain.

Re: HTTPS on load balancer

Scott Finegan — Thu, 01 Dec 2016 15:55:16 -0500

I am not sure exactly what you want between LB and Phorum, but this works for most who want https between the browser and Phorum, or http between the browser and Phorum. It should work with any passed URL regardless of source.

Automatic HTTP Path (version 1.0.9)
This module automatically sets the HTTP Path configuration option, based on the active
URL. This can be useful if for some reason you run one Phorum install under various host
names and/or directories (e.g. a Phorum on a private space intranet server that is also
accessible through a public URL or a server that has to be accessible on both an http://
and https:// URL).

Automatic HTTP Path

In the Admin under General Settings, File/Path Settings... you may need to change this, not sure...

HTTPS on load balancer

Schurki — Thu, 01 Dec 2016 13:28:00 -0500

We're terminating SSL encryption on the load balancer, communication between the LB and the web servers is unencrypted. The LB adds a HTTP header "isSSL: true" on imcoming HTTPS requests. To make Phorum work in this setup, I added a file include/phorum_get_protocol.php and made a few changes to common.php and include/phorum_get_url.php.

I'ld like to append the files here, but this doesn't seem to be possible, so I put it this way:

get_protocol. php:

Language: PHP

 
$allheaders= getallheaders();
if (isset($allheaders{';isSSL';}) and $allheaders{';isSSL';} == ';true';) {
   $protocol = ';https';;
}
else {
 $protocol = ';http';;
}
?>

In common.php, I added

Language: PHP
require_once("include/phorum_get_protocol.php");

after the other includes and

Language: PHP
$PHORUM[';http_path';] = preg_replace ("!^https?!" , $protocol , $PHORUM[';http_path';]);

after

Language: PHP
phorum_db_load_settings();

and in phorum_get_url.php I put

Language: PHP
global $protocol;
 $url= preg_replace ("!^https?!" , $protocol , $url);

just before

Language: PHP
return $url;

in each of the functions phorum_get_url, phorum_get_url_no_uri_auth and phorum_get_current_url.

This refers to version 5.2.20.

Would somebody integrate that in proper form in Phorum, perhaps as a module? The name and value of the header sent by the LB should probably be configurable.